1. Who we are
This website is operated by Gastronom(the "Controller"), an Eastern European delicatessen based in Liguria, Italy.
Contact for privacy requests: privacy@gastronom.local (replace with your real contact email before launch).
Shop address (placeholder until company details are finalized): Via Roma 42, Liguria, Italy. Phone: +39 0185 123 456.
2. What data we collect
Depending on how you use the shop, we may process:
- Account data: name, email, phone, delivery address, password (hashed by our auth provider).
- Order data: items purchased, amounts, shipping details, payment status, order history.
- Payment data: processed by Stripe. We do not store full card numbers on our servers.
- Technical data: session cookies needed to keep you logged in, and cart/wishlist data stored locally or in our database when you are signed in.
- Communications: emails about orders (confirmation, status updates, modification proposals).
3. Why we process your data (legal bases)
- Contract (Art. 6(1)(b) GDPR): creating an account, processing orders, delivering products, sending order-related emails.
- Legal obligation (Art. 6(1)(c)): tax and accounting retention of invoices and order records.
- Legitimate interests (Art. 6(1)(f)): shop security, fraud prevention, improving service reliability.
- Consent (Art. 6(1)(a)): optional cookies (analytics/marketing) and any future newsletter signup.
4. Who we share data with
We use processors who help us run the shop:
- Supabase — authentication, database, file storage (hosting may include regions outside the EU; covered by their DPA and Standard Contractual Clauses where required).
- Stripe — payment processing.
- Resend — transactional email delivery.
- Hosting / CDN — e.g. Vercel for serving the website.
We do not sell your personal data. We only share what is needed for each provider to perform their service.
5. How long we keep data
- Account profile: while your account is active, then deleted or anonymized on verified deletion request (except records we must keep by law).
- Orders & invoices: typically retained for the Italian tax/accounting period (commonly up to 10 years).
- Cookie consent choice: stored in your browser until you clear site data or change preferences.
- Support emails: as long as needed to resolve the request, then archived or deleted.
6. Your rights
Under the GDPR you can ask us to:
- Access your personal data
- Correct inaccurate data
- Delete data (where no legal duty to retain applies)
- Restrict or object to certain processing
- Receive a portable copy of data you provided
- Withdraw consent for optional cookies / marketing at any time
You may also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).
7. Cookies
Details about cookie categories and how to manage them are in our Cookie Policy.
8. Children
The shop is not directed at children under 16. We do not knowingly collect their data.
9. Changes
We may update this policy when our practices or legal requirements change. The "Last updated" date at the top will reflect the latest version.