Personal data
privacy notice.

1. Who handles your data

The data controller is Costruttori Italiani di Soluzioni Innovative S.r.l.: natuRa.Ely is a brand of the company. Registered office at Via Gian Giacomo Porro 4, 00197 Rome (RM), Italy. The atelier and show-room, where the garments are made and can be tried on, are in Arco (TN), on Lake Garda.

Legal name

Costruttori Italiani di Soluzioni Innovative S.r.l.

Registered office

Via Gian Giacomo Porro 4, 00197 Rome (RM), Italy

Brand

natuRa.Ely

Atelier and show-room

Arco (TN), Lake Garda

VAT number and tax code

11031661009

REA registration

RM 1273250

Share capital

€ 10,000.00

Certified email (PEC)

cisimedextreme@pec.it

Email

naturaely@libero.it

Telephone

+39 349 410 6100

We have not appointed a Data Protection Officer, as the conditions of Art. 37 GDPR do not apply to us. Write to the address above about anything concerning your data: one of the two of us will answer.

2. What we collect

• contact details: first name, surname, email address, telephone number;
• shipping and invoicing details: address, tax code or VAT number where required;
• the content of the messages you send us, including measurements and requests for made-to-measure alterations;
• technical browsing data: IP address, device and browser type, pages visited, collected by our hosting provider for security and operation;
• order data: the pieces purchased, the amount, the payment session identifier and its outcome;
• the contents of your basket and your choice about external content, kept in your own device’s memory. When you start payment, only the identifiers of the pieces you chose reach our server, and a technical cookie links your browser to the temporary reservation of those pieces while the payment session remains open.

Your card details never reach us. Payment takes place on Stripe’s secure page, which collects and processes the payment data directly: we never see it and never store it in any form. From Stripe we receive only the information needed to handle the order, such as name, email, delivery address, amount and payment outcome.

Today the site collects no data through forms: the contact form and the atelier-letter sign-up are not yet connected to any service and send nothing. Write to the atelier by email.

3. Why we process it, and on what grounds

Online payment, temporary reservation and recording the status of one-of-one pieces

Performance of a contract and pre-contractual measures — Art. 6(1)(b) GDPR.

Fulfilling your order and looking after you afterwards

Performance of a contract — Art. 6(1)(b) GDPR.

Invoicing and tax obligations

Compliance with a legal obligation — Art. 6(1)(c) GDPR.

Answering your enquiries and booking atelier visits

Pre-contractual measures — Art. 6(1)(b) GDPR.

Atelier letter (newsletter)

Your consent, freely given and withdrawable at any time — Art. 6(1)(a) GDPR. Withdrawal does not affect processing carried out beforehand. Service not yet active.

Technical cookies and site security

Legitimate interest — Art. 6(1)(f) GDPR and Art. 122 of the Italian Privacy Code.

Defending our rights in legal proceedings

Legitimate interest — Art. 6(1)(f) GDPR.

Reg. (EU) 2016/679 · It. Legislative Decree 196/2003 as amended by Decree 101/2018

4. What is necessary and what is not

The fields marked as required in our forms are the ones we cannot do without: no address, no delivery and no invoice. Everything else — the atelier letter, your telephone number, the notes to the seamstress — is optional, and declining changes nothing between us.

5. Who else sees it

Your data is shared only with those we need in order to get the garment to you and keep our books in order, and only to the extent necessary:

• the courier or postal operator making the delivery;
• the firm that keeps our accounts;
• Stripe, which runs the payment page and carries out the payment: it receives the data needed for the transaction and processes it under its own contractual terms and privacy policy;
• Cloudflare, which delivers the site technically and hosts the infrastructure we use to check availability and record reservations and orders (servers, Worker and D1 database), under its own contractual terms and privacy policy;
• the provider of our email mailbox, for correspondence with you;
• Google Ireland Limited, which delivers the site’s typefaces to your browser (Google Fonts): it receives your IP address and browser technical data, and sets no cookies;
• OpenStreetMap Foundation, which serves the atelier map, and only if you allow it to load;
• public authorities, where the law requires it.

We do not sell, rent or trade your data with anyone. We run no behavioural advertising and share no addresses for anyone else’s marketing.

6. Transfers outside the European Union

Some of the providers we use, including Stripe and Cloudflare, may process data outside the European Economic Area. Where that happens, the transfer relies on the mechanisms set out in each provider’s contractual documentation: an adequacy decision of the European Commission (Art. 45 GDPR) or the Commission’s standard contractual clauses (Art. 46(2)(c)), with any supplementary measures required. You may ask us for a copy of the safeguards in place.

In practice: loading the typefaces from Google Fonts means your IP address is disclosed to Google Ireland Limited, which may transfer it to Google LLC in the United States on the basis of the adequacy decision of 10 July 2023 (EU–US Data Privacy Framework). We are considering hosting the typefaces on our own server, which would remove this disclosure altogether.

7. How long we keep it

Order records and invoices

Ten years, as Italian civil and tax law requires (Art. 2220 of the Civil Code).

Enquiries and appointment requests

Twenty-four months from our last exchange.

Atelier letter subscription

Until consent is withdrawn; proof of consent is kept for as long as we must be able to demonstrate it.

Technical server logs

No longer than twelve months.

8. Your rights

At any time you may ask us for access to your data, its correction or erasure, restriction of processing, portability in a readable format, and you may object to processing based on legitimate interest (Arts. 15–22 GDPR). An email to naturaely@libero.it is enough: we reply within one month, as Art. 12 provides.

If you believe the processing is unlawful you may lodge a complaint with the Italian supervisory authority, Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome — garanteprivacy.it — with the authority of your own country of residence, or bring the matter before a court.

9. No profiling

There is no automated decision-making, no profiling, and no commercial profile is built of the people who write to us or buy from us.

10. Minors

This site is not aimed at children under sixteen and we do not knowingly collect their data. If you notice that a child has sent us personal data, write to us and we will erase it at once.

11. Security

The site runs over an encrypted connection. Access to our mail and order records is limited to the two of us, with personal credentials. We apply technical and organisational measures appropriate to the risk under Art. 32 GDPR, and in the event of a breach we act under Arts. 33 and 34.

12. Changes to this notice

If the way we handle data changes, this page and the date at the top will be updated. Substantial changes are announced to those subscribed to the atelier letter.

A small atelier gathers little data, and treats it the way it would treat cloth: carefully, and without waste.