Privacy policy

Last updated: 19 October 2026.

This notice explains how personal data are processed in connection with the ALBERTO GALLINARI store, purchases and communications. It provides information; browsing the store is not consent to optional marketing or tracking.

1. Controller and contact

The controller for the merchant's processing is GALLINARI ALBERTO, a sole trader trading as ALBERTO GALLINARI, Corso Martiri della Libertà 25, 25122 Brescia (BS), Italy. Contact info@albertogallinari.com or +39 346 326 0115 for privacy questions or rights requests.

2. Data, sources, purposes and legal bases

We receive information directly from you when you order, contact us, use an account or subscribe; from the store and your device when you browse; and from service providers handling payments, delivery and other requested services.

  • Orders, enquiries and customer support: name, email, telephone where provided, billing and delivery addresses, selected products, order and transaction references, payment status, and correspondence. We use these data to take steps you request before a contract, perform the sale, arrange delivery, handle returns and provide guarantee support (GDPR Article 6(1)(b)), and to meet legal duties where applicable (Article 6(1)(c)).
  • Accounts and store operation: contact and account identifiers, order history, preferences, device and browser information, IP address and necessary session data. Processing necessary to provide requested account and shopping functions relies on the contract or requested precontractual steps. Necessary security and fraud checks rely on our legitimate interests in protecting customers, payments and the store, subject to your rights and the balancing required by Article 6(1)(f), or on a specific legal obligation where applicable.
  • Accounting and legal duties: invoice, transaction, tax and relevant customer records are processed to comply with applicable legal obligations (Article 6(1)(c)).
  • Email newsletters: email address, subscription source, consent and subscription preferences are used for ALBERTO GALLINARI news, collections and offers on the basis of consent (Article 6(1)(a)). Shopify provides our newsletter service. An order or enquiry does not by itself subscribe you.
  • Optional analytics, personalisation and advertising: device and cookie identifiers, browsing and shopping activity and related preferences may be processed through the services described below. Where consent is required for tracking and the associated processing, consent is the basis; optional consent is separate from purchasing.
  • Rights requests and disputes: relevant correspondence, request details, identity verification information where necessary, and consent or objection records are processed to meet legal obligations and, where applicable, our legitimate interests in establishing, exercising or defending legal claims.

Payment details required for a payment method are handled by the payment provider. The merchant's processing concerns the order and transaction information needed to administer payment, refunds and disputes. Do not send full card numbers, card security codes or account access codes to our support email.

Fields required for an order or a legal obligation are necessary for that purpose; without them we may be unable to fulfil the request. Newsletter subscriptions and optional tracking choices are voluntary.

3. Newsletter and other choices

You can withdraw newsletter consent at any time using the unsubscribe link in a marketing email or by contacting us. We stop promotional use following withdrawal or objection; messages needed to fulfil an order or meet a legal obligation are separate. Withdrawal does not affect the lawfulness of processing before it was withdrawn. Cookie and advertising choices are explained in our Cookie Policy.

4. Recipients and Shopify

Data necessary for a service are disclosed to ecommerce and hosting providers, payment providers, carriers and logistics providers, technical and customer support suppliers, and professional advisers acting under appropriate arrangements. Public authorities and parties involved in lawful claims may receive information where required or permitted by law. Access and disclosure are limited to the relevant purpose. Our use of an external provider does not remove our responsibilities as controller.

Shopify operates the ecommerce platform and newsletter infrastructure. For processing on our instructions, Shopify acts as a processor under its Data Processing Addendum. Shopify may act as a controller for its own consumer services and enhanced services.

Shopify Network Intelligence is enabled. This allows Shopify to use information about interactions with this store together with information from other merchants and Shopify to improve services, personalise shopping and support advertising. Information can include contact and device identifiers and browsing, shopping and transaction activity. The applicable consent and other privacy choices govern optional tracking and use. Shopify's own purposes, legal bases, recipients, retention and safeguards are explained in the Shopify Consumer Privacy Policy. You can exercise rights concerning Shopify's own processing through its Privacy Portal.

Payment services you select at checkout may act as separate controllers under their own notices. For example, where you select Viva.com, its privacy notice explains that provider's processing. Carrier and other service information relevant to your order can also be requested from us.

Meta advertising and measurement: the Facebook & Instagram integration uses browser and server event sharing, including the Meta pixel and Conversions API. These tools support measuring visits and purchases, attributing advertising and selecting audiences. Data can include browsing and shopping events, device and cookie identifiers, and customer contact information used to match events to a Meta account. Optional advertising tracking and the associated sharing require consent where applicable; server-to-server transmission does not remove that requirement. You can decline Marketing in cookie preferences and object to direct marketing. Meta's processing and additional controls are described in its Privacy Policy and Cookie Policy. The Meta Controller Addendum explains the allocation of responsibilities for joint processing where applicable. You may direct rights requests to us or the relevant Meta entity.

5. International transfers

The store's Shopify data hosting setting is the European Union. Hosting location alone does not mean that every processing operation or provider is confined to the EU. Shopify and its service providers may process data in other countries, including Canada, the United States and Singapore. Where applicable, transfers rely on an adequacy decision or appropriate safeguards such as Standard Contractual Clauses and necessary supplementary measures. Shopify describes its arrangements in its Data Processing Addendum and privacy notices linked above. Contact us for information about the safeguards relevant to your data and how to obtain a copy. Browsing or purchasing is not consent to unrestricted international transfers.

6. Retention and security

Retention is determined separately for each purpose:

  • Order and support records are retained while fulfilling the order or request and for the applicable guarantee, complaint and legal claim periods. Records needed for an unresolved dispute are retained until it is resolved and the relevant legal obligations have ended.
  • Accounting and tax records are retained for the statutory period applicable to the particular record. A legal requirement to retain an invoice does not justify retaining unrelated browsing or marketing information for the same period.
  • Account information is retained while needed to provide the account and until closure or an erasure request is addressed, subject to any separate obligation to retain order or legal records.
  • Newsletter subscription data are used while the subscription and consent remain active. On withdrawal or objection, promotional use stops. A limited suppression record and necessary evidence of the choice may be retained to respect the objection and demonstrate compliance for the relevant claim period.
  • Necessary technical and security information is retained for the functioning of the service and the period needed to investigate a specific security or fraud issue. Cookie lifetimes depend on the technology and are explained through the Cookie Policy and linked provider schedule.

Data are deleted or anonymised when no longer needed for an applicable purpose, subject to lawful retention requirements. We use appropriate technical and organisational security measures. Please avoid sending unnecessary sensitive information with an enquiry.

7. Personalisation and automated processing

Optional advertising and personalisation can use browsing and shopping activity to infer interests and select relevant products or advertising. You can control consent-based uses through cookie preferences and object to direct marketing and related profiling. Security and payment providers may use automated risk checks. If a decision affecting your order is communicated to you, contact us for an explanation and review. Where GDPR Article 22 applies, your rights concerning decisions based solely on automated processing with legal or similarly significant effects, including applicable rights to human intervention, to express your view and to contest a decision, remain available.

8. Your rights and complaints

Subject to the GDPR's conditions, you may request access, correction, erasure, restriction and portability. You may object to processing based on legitimate interests on grounds relating to your situation. You may object to direct marketing, including related profiling, at any time. You may withdraw consent without affecting prior lawful processing.

Contact info@albertogallinari.com. We may request only information reasonably needed to verify identity. We normally respond within one month; where a lawful extension is needed because of complexity or the number of requests, we will explain it within that month. You may complain directly to the Italian Garante per la protezione dei dati personali or another competent supervisory authority without first complaining to us.

Other mandatory local privacy rights remain available. Where applicable US state laws give a right to opt out of sale, sharing or targeted advertising, use Your Privacy Choices. In the regions supported by that control, Shopify also processes applicable Global Privacy Control opt-out signals. This US opt-out mechanism does not replace consent where Italian or European law requires it.

9. Children, external services and updates

The store is intended for customers able to enter into purchases lawfully. If you believe a child has provided data in circumstances requiring parental authority, contact us so we can assess and address the situation. External services you choose may have their own privacy notices. We update this notice when relevant practices or legal requirements change and provide additional notice where required. An update does not create consent to a new optional purpose.