Skip to main content

Privacy policy

 

PRIVACY POLICY

Last updated: August 31, 2026

This Privacy Policy describes how ALESSANDRAGALLO S.r.l. collects, uses, stores and discloses the personal data of users who visit alessandragallo.it (the “Website”), make purchases, create an account, subscribe to marketing communications, use the wishlist, complete forms, interact with the services available on the Website or contact customer service.

1. Data Controller

The Data Controller is:

ALESSANDRAGALLO S.r.l.
Via San Luca 4/30
16124 Genoa (GE) – Italy
VAT No. 02665690992
Email: info@alessandragallo.it

For any request relating to this Privacy Policy or to the exercise of rights concerning personal data protection, you may contact the Data Controller using the details above.

2. Categories of Personal Data Collected

Depending on how users interact with the Website, we may collect and process the following categories of personal data:

Identification and contact data, such as first name, last name, email address, telephone number, shipping address and billing address.

Order and purchase data, such as products purchased, amounts, order history, returns, refunds, delivery information and purchase-related preferences.

Payment-related data, limited to the information necessary to process the transaction. Payments are processed through the payment service providers available at checkout. ALESSANDRAGALLO S.r.l. does not directly store full payment card details.

Customer account data, such as information associated with the account, authentication details, preferences and activity history, where applicable.

Wishlist data, including products saved as favourites, session or device identifiers and other information necessary for the operation and synchronisation of the wishlist.

Communication data, such as information provided when a user completes a form, sends an email, uses messaging tools or requests assistance.

Marketing and preference data, such as email address, marketing preferences, consent given, withdrawal of consent and information relating to interaction with communications sent.

Technical and usage data, such as IP address, browser type, device, operating system, online identifiers, session data, pages viewed, interactions with the Website and technical browsing information.

Data collected through cookies and similar technologies, including cookies, pixels, local storage and other identifiers, as described in this Policy and according to the preferences expressed by the user.

3. Sources of Personal Data

Personal data may be:

  • provided directly by the user, for example when making a purchase, creating an account, completing a form, subscribing to the newsletter or contacting customer service;
  • collected automatically while using the Website through cookies, pixels, logs, local storage and similar technologies;
  • received, to the extent permitted by law, from providers and partners used for operating the Website, processing payments, handling shipping, analysing performance, measuring campaigns or providing other services connected with the online store.

4. Nature of Data Provision

Providing the data necessary to place an order, receive a service, obtain assistance or comply with legal obligations is necessary in order for us to fulfil the relevant request.

Failure to provide such data may make it impossible to conclude or perform the contract, manage the order, arrange delivery or provide the requested service.

Providing data for marketing purposes or for other purposes based on consent is optional.

Refusing consent for marketing purposes does not affect the ability to browse the Website or make purchases.

5. Purposes of Processing and Legal Bases

Personal data may be processed for the following purposes.

Order Management and Contract Performance

We use personal data to process purchases, manage payments, prepare and ship orders, arrange deliveries, manage returns, refunds, exchanges, requests and customer service.

Legal basis: performance of a contract or taking steps at the request of the data subject prior to entering into a contract.

Compliance with Legal Obligations

We may process and retain certain data in order to comply with tax, accounting, administrative and other obligations imposed by applicable law.

Legal basis: compliance with a legal obligation.

Security, Fraud Prevention and Website Protection

We may use technical, identification and transaction-related data to prevent fraud, abuse, unauthorised access, unlawful use of the Website and to ensure the security of our systems.

Legal basis: the legitimate interest of the Data Controller in ensuring security, preventing fraud and protecting its business, where applicable.

Customer Service and Request Management

We use personal data to respond to requests for information, assistance, after-sales support or other communications sent by the user.

Legal basis: taking pre-contractual steps, performance of a contract or legitimate interest in managing customer requests, depending on the circumstances.

Newsletter and Marketing Communications

If a user chooses to subscribe, we use personal data to send communications relating to products, collections, news, events, promotions and other marketing information.

Legal basis: the data subject’s consent, where required by applicable law.

Consent may be withdrawn at any time by using the unsubscribe link included in communications or by contacting the Data Controller.

Personalisation, Analytics and Advertising

Subject to consent where required, we may use cookies and similar technologies to understand how the Website is used, measure its performance, personalise the user experience, measure advertising campaigns and display more relevant content or advertisements.

Legal basis: consent, where required by applicable law.

Protection of the Data Controller’s Rights

Personal data may be processed, to the extent permitted by law, in order to establish, exercise or defend the rights of ALESSANDRAGALLO S.r.l. in judicial or out-of-court proceedings, and to respond to lawful requests from competent authorities.

Legal basis: legitimate interest of the Data Controller and/or compliance with legal obligations.

6. Shopify

Our online store is hosted on Shopify, which provides ALESSANDRAGALLO S.r.l. with the technological infrastructure necessary to operate the Website, checkout, orders and e-commerce services.

When users visit the Website, make a purchase or interact with the store, Shopify may collect and process information relating to browsing, devices, purchases, transactions and interactions with the store.

Shopify Network Intelligence is enabled on our store.

This allows Shopify to securely use information relating to the user’s interaction with our store, with Shopify and, where applicable, with other Shopify merchants in order to provide advanced services and features, including functions relating to personalisation, security, analytics, performance measurement and marketing.

Certain information may be processed or disclosed by Shopify and its service providers in countries other than the country in which the user resides.

Other Shopify merchants cannot directly access the personal data of ALESSANDRAGALLO S.r.l. customers through Shopify Network Intelligence.

For more information on how Shopify processes personal data, users may consult Shopify’s Privacy Policy.

Users may also use the Shopify Privacy Portal to obtain further information and, where applicable, exercise choices and rights in relation to processing carried out by Shopify.

7. Shopify Email and Marketing Communications

We use tools provided by Shopify to manage and send emails and newsletters.

When a user subscribes to marketing communications, we may process the email address, marketing preferences and information relating to interaction with communications sent, such as email openings or interactions with links, where permitted.

Users may withdraw their consent at any time by using the unsubscribe link included in the communications.

8. Wishlist Plus / Swym

The Website uses Wishlist Plus, a service provided by Swym, to allow users to save products as favourites and find them again later.

To provide this functionality, the following data may be processed:

  • products saved in the wishlist;
  • session or device identifiers;
  • technical data necessary for the operation of the service;
  • email address, where provided by the user or associated with the relevant account.

The service may use cookies, local storage and similar technologies for the operation of the wishlist, storage of preferences and synchronisation of saved products.

The use of technologies that are not strictly necessary is subject to the preferences expressed by the user through the consent management tools available on the Website.

9. Analytics, Social Media and Advertising

Subject to the user’s consent, where required, we use integrations and services that allow us to measure the performance of the Website and advertising campaigns, understand user interaction and improve our marketing activities.

The Website currently uses integrations with:

Google & YouTube, for analytics, measurement, marketing and advertising services;

Meta – Facebook & Instagram, for conversion measurement, marketing and advertising;

Pinterest, for measurement, marketing and advertising;

TikTok, for measurement, marketing and advertising.

Some of these integrations may use browser-side and/or server-side technologies.

Where required by applicable law, non-essential analytics, personalisation or marketing activities are carried out in accordance with the preferences expressed by the user through the consent management system.

10. Cookies and Similar Technologies

The Website uses cookies and similar technologies, including pixels, local storage and other identifiers.

The technologies used may be divided into the following categories.

Necessary Cookies

These are essential for the operation of the Website and may be used, for example, for the shopping cart, checkout, security, session management, authentication and other essential functions.

Such cookies do not require consent where they are strictly necessary to provide a service explicitly requested by the user.

Personalisation Cookies

These allow preferences to be stored and certain functions and content of the Website to be personalised.

Analytics Cookies

These allow us to understand how users interact with the Website, measure its performance and improve the browsing experience.

Marketing Cookies

These may be used to measure the effectiveness of advertising campaigns, understand interaction with advertisements and display more relevant marketing communications.

For users located in areas where consent is required, technologies that are not strictly necessary are used only in accordance with the preferences expressed through the cookie banner.

Users may change or withdraw their preferences at any time by using the “Cookie Preferences” function available on the Website.

11. Payments

Payments made through the Website are processed through Shopify and/or the relevant payment service providers.

Depending on the country, device and availability of services, payment methods may include credit and debit cards, Shop Pay, Apple Pay, Google Pay, PayPal, Klarna and other methods displayed at checkout.

When the user chooses a specific payment method, the data necessary for the transaction may be processed by the relevant provider in accordance with its own privacy policy and terms.

ALESSANDRAGALLO S.r.l. does not directly store full payment card details.

12. Shipping and Delivery

In order to fulfil orders, we may disclose to couriers and logistics service providers the information necessary for delivery, such as:

  • first and last name;
  • address;
  • telephone number;
  • email address;
  • shipping-related information.

We use, among others, DHL Express services where necessary for order fulfilment.

Legal basis: performance of a contract.

13. Forms, Messaging and Customer Service

When users complete a form on the Website, submit a request or use messaging or customer support tools, we process the data provided in order to respond to the request and provide the requested service.

The data processed may include first name, last name, email address, telephone number, the content of the communication and other information voluntarily provided by the user.

14. Recipients of Personal Data

Personal data may be disclosed, only to the extent necessary, to the following categories of recipients:

  • Shopify and its service providers and sub-processors;
  • payment service providers;
  • couriers and logistics providers;
  • IT, hosting and technological infrastructure providers;
  • providers of e-commerce tools and functionality;
  • wishlist service providers;
  • analytics, marketing and advertising platforms, subject to consent where required;
  • consultants, accountants, lawyers and other professional advisers;
  • public, administrative or judicial authorities where required by law.

Some providers may act as processors on behalf of ALESSANDRAGALLO S.r.l.; others may act as independent controllers for processing activities within their respective area of responsibility.

15. International Data Transfers

Some of the providers we use may process personal data outside the European Economic Area.

Where required under the GDPR, such transfers are carried out on the basis of an adequacy decision by the European Commission or subject to appropriate safeguards provided for under applicable law, such as Standard Contractual Clauses, unless another valid legal basis for the transfer applies.

16. Data Retention

Personal data is retained for as long as necessary for the purposes for which it was collected and, thereafter, for the period required or permitted by applicable law.

In particular:

  • data relating to orders and contracts is retained for the period necessary to manage the relationship and subsequently for the periods required under civil, tax and accounting laws;
  • customer service data is retained for the period necessary to manage the request and, where necessary, to protect the Data Controller’s rights;
  • data processed on the basis of consent for marketing purposes is retained until consent is withdrawn or until it is no longer necessary for the relevant purposes;
  • technical data and data relating to cookies or other identifiers is retained according to the retention periods applicable to the specific technologies and services used;
  • data may be retained for a longer period where necessary to comply with legal obligations, orders from authorities or to establish, exercise or defend legal claims.

At the end of the applicable retention period, personal data is deleted or anonymised, unless further retention is required by law.

17. Data Security

ALESSANDRAGALLO S.r.l. adopts appropriate technical and organisational measures having regard to the nature of the data processed and the risks associated with the processing, in order to reduce the risk of unauthorised access, loss, disclosure, alteration or destruction of personal data.

However, no electronic transmission or storage system can guarantee absolute security.

18. Data Subject Rights

In the cases and within the limits provided for by Regulation (EU) 2016/679 (“GDPR”), data subjects have the right to:

  • obtain confirmation as to whether or not personal data concerning them is being processed;
  • obtain access to their personal data;
  • request correction of inaccurate data or completion of incomplete data;
  • request erasure of personal data where provided for by law;
  • request restriction of processing;
  • object to processing where provided for by law;
  • receive personal data in a structured, commonly used and machine-readable format where the right to data portability applies;
  • withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.

Where personal data is processed for direct marketing purposes, the data subject has the right to object to such processing at any time.

To exercise these rights, users may contact:

info@alessandragallo.it

Requests will be handled within the time limits provided for by applicable law.

19. Right to Lodge a Complaint

Data subjects have the right to lodge a complaint with the competent supervisory authority if they believe that the processing of their personal data infringes applicable data protection law.

In Italy, the competent supervisory authority is the Garante per la protezione dei dati personali.

20. Minors

The Website and its services are not specifically intended for minors.

ALESSANDRAGALLO S.r.l. does not knowingly collect personal data from minors in breach of applicable law.

If the Data Controller becomes aware that personal data relating to a minor has been collected in breach of applicable rules, appropriate measures will be taken.

21. System Logs and Maintenance

For operational, security and maintenance purposes, the Website and certain service providers may collect technical logs relating to interactions with the Website, including system logs, IP addresses and other technical information.

Such data is processed to ensure the proper operation, security and integrity of the systems.

22. Requests from Authorities

ALESSANDRAGALLO S.r.l. may disclose personal data to public, administrative or judicial authorities where required by law, pursuant to a lawful order or where necessary to protect its own rights or those of third parties.

23. Changes to this Privacy Policy

ALESSANDRAGALLO S.r.l. may update this Privacy Policy from time to time to reflect changes in its practices, services used, technologies adopted or applicable law.

The updated version will be published on this page together with the date of the latest update.

Where changes affect processing activities based on consent and applicable law requires renewed consent, new consent will be requested.

24. Contact Details

For any questions relating to this Privacy Policy or to exercise data protection rights, please contact:

ALESSANDRAGALLO S.r.l.
Via San Luca 4/30
16124 Genoa (GE) – Italy
VAT No. 02665690992
Email: info@alessandragallo.it