Legal information
Privacy Policy
Calzature Maxstyle Sas di Marzocchi Valeria & C., with registered office at Via O. Malagodi, 19/A-B, 44042 Cento (FE) – Italy, C.F./P. IVA 00397090382, REA: FE – 100477, the owner of the website available at maxstyle.it, as well as any other domains, subdomains, or addresses associated with the same online store, www.maxstyle.it (hereinafter, the “Website”), informs users and customers (hereinafter, the “Users” or “Data Subjects”) that personal data relating to browsing the Website, creating and managing an account, purchases, payments, returns and refunds, requests for assistance, and use of additional services will be processed in accordance with Regulation (EU) 2016/679 (“GDPR”), Legislative Decree 196/2003, as amended, and applicable data protection legislation. This privacy notice is provided pursuant to Articles 13 and 14 of the GDPR and does not apply to third-party websites or services that may be accessed through links, integrations, or connections on the Website, which are governed by their respective privacy notices.
1. DATA CONTROLLER
The data controller is Calzature Maxstyle Sas di Marzocchi Valeria & C., with registered office at Via O. Malagodi, 19/A-B, 44042 Cento (FE) – Italy, C.F./P. IVA 00397090382, REA: FE – 100477 (hereinafter, the “Controller”). For matters relating to the protection of personal data and to exercise the rights provided for under the GDPR, the Controller can be contacted at support@maxstyle.it.
2. PURPOSES AND LEGAL BASES FOR DATA PROCESSING
a) Enable proper navigation and operation of the Website. Technical and browsing data necessary for the operation of the Website, session management, the shopping cart, checkout, security, and strictly necessary preferences are processed to provide the services requested by the User pursuant to Art. 6(1)(b) of the GDPR and, where applicable, on the basis of the Controller’s legitimate interest in ensuring the security, integrity, and proper operation of the Website pursuant to Art. 6(1)(f) of the GDPR.
b) Enable the use of the customer account features. The Website may make customer account features available to Users, provided and technically managed through the Shopify platform, which allow them, among other things, to authenticate, view their order history, manage profile information and addresses, check order status, and access any available return features or other restricted services. Calzature Maxstyle Sas di Marzocchi Valeria & C. processes personal data related to the use of the customer account to make these features available and manage its relationship with the User, under Article 6(1)(b) of the GDPR. The technical management of the account and its authentication systems is carried out through Shopify, as specified in the section dedicated to recipients and platform providers. Providing the required data is necessary to use the relevant features.
c) Manage the purchasing process and perform sales contracts. Identification, contact, billing, and shipping data; data relating to orders, products, returns, the right of withdrawal, refunds, the statutory warranty, and related communications are processed to take pre-contractual steps at the Data Subject’s request and to conclude and perform the contract under Article 6(1)(b) of the GDPR, as well as to comply with legal obligations relating to the sale under Article 6(1)(c) of the GDPR.
d) Manage payments, receipts, refunds, and related checks. Transaction data is processed to receive and reconcile payments, issue refunds, manage disputes and chargebacks, conduct fraud prevention checks, and carry out any other activities necessary to complete a purchase or return. The legal basis is Article 6(1)(b) of the GDPR and, for legal and accounting obligations, Article 6(1)(c) of the GDPR; fraud prevention and management activities may also be based on the Controller’s legitimate interest in transaction security under Article 6(1)(f) of the GDPR. Full payment instrument details, such as the complete card number and associated security codes, are collected and processed by payment service providers in accordance with their respective systems and are not stored directly by the Controller.
e) Handle requests, support, and customer service. Data provided by email, telephone, contact forms, messaging, or other support channels are processed to respond to User requests and manage pre-contractual, contractual, and after-sales activities. The legal basis is Art. 6(1)(b) GDPR when the request concerns a contractual or pre-contractual relationship and, in other cases, the Data Controller’s legitimate interest in responding to requests received, pursuant to Art. 6(1)(f) GDPR.
f) Prevent abuse, fraud, and unlawful use of the Website and transactions. The Data Controller may process data relating to browsing, accounts, orders, and transactions to check for anomalies, attempted fraud, unauthorized use of payment instruments, unauthorized access, or breaches of the applicable terms. Processing is based on the Data Controller’s legitimate interest in the security of the Website and transactions and the protection of its assets, pursuant to Art. 6(1)(f) GDPR, and, where applicable, on compliance with legal obligations pursuant to Art. 6(1)(c) GDPR.
g) Send newsletters and commercial communications. The email address and any other data used to send newsletters, promotional communications, and commercial offers are processed on the basis of the Data Subject’s consent pursuant to Art. 6(1)(a) GDPR, except in cases where the law allows communications about similar products or services without renewed consent. Consent is optional and may be withdrawn at any time using the link included in the communications or by contacting the Data Controller.
h) Conduct statistical analyses, measurement, and marketing activities using cookies or similar technologies. Processing carried out using cookies and other technologies that are not strictly necessary, including non-anonymized analytics tools, campaign measurement, personalization, and advertising, is carried out with the User’s consent pursuant to Art. 6(1)(a) GDPR, where such consent is required. Detailed information, retention periods, and procedures for managing preferences are described in the Website’s Cookie Policy.
i) Comply with legal, tax, accounting and administrative obligations. Data are processed to comply with obligations under applicable law, including provisions on tax, accounting, consumer protection, product safety and cooperation with authorities. The legal basis is Art. 6(1)(c) GDPR.
j) Establish, exercise or defend legal claims. Data may be processed to handle complaints, disputes and controversies, recover debts, protect the Controller’s rights or defend against claims by third parties, on the basis of the Controller’s legitimate interest pursuant to Art. 6(1)(f) GDPR.
3. TYPES AND SOURCES OF DATA PROCESSED
The Site is not intended for purchases by persons under the age of 18. The Controller does not knowingly intend to collect personal data from minors to enable them to make purchases on the Site.
3.1. Browsing and technical data
During normal browsing, IP addresses, device and session identifiers, browser and operating system data, connection information, URLs and pages visited, dates and times of requests, technical events, security logs and other data generated through interaction with the Site may be processed. Such data may be processed by the Controller, Shopify and other technical providers involved to deliver the service, ensure security and functionality, prevent misuse and, where permitted, produce usage statistics.
3.2. Cookies and similar technologies
The Site uses cookies, pixels, tags, local storage and similar technologies. Strictly necessary cookies are used to operate the Site and its related features; preference, analytics and marketing technologies are used within the limits and according to the choices expressed by the User through the consent management system. For detailed information about the individual tools, providers, purposes, retention periods and procedures for withdrawing or changing consent, please refer to the Cookie Policy available on the Site.
3.3. Account, order and contractual relationship data
The following may be processed: first and last name, email address, telephone number, credentials and information required to manage the account, shipping and billing addresses, any tax code or other tax details, products purchased or returned, amounts, discounts, shipping and delivery methods, order status, information relating to withdrawal, returns, exchanges, refunds, warranties and after-sales support.
3.4. Payment and refund data
The Controller may receive information relating to the transaction, such as the payment method used, amount, currency, authorization or payment status, transaction identifiers, partially masked payment instrument details, and information necessary for refunds, disputes or reconciliations. Full card details and confidential payment credentials are processed by payment service providers in accordance with their respective privacy notices and terms.
3.5. Data relating to third parties
The User may provide data about a third party, for example when specifying a different recipient for delivery or purchasing a gift. Such data is processed solely to the extent necessary to fulfill the order and carry out related activities. Users are invited to provide third-party data only when authorized to do so. The Controller will provide the third party with the information required by Article 14 GDPR in the cases and within the time limits provided for by applicable law.
3.6. Data from sources other than the Data Subject
Some data may be received from Shopify, Sugo S.n.c., payment service providers, banks, wallets, payment networks, couriers, carriers, anti-fraud services, applications integrated into the Website or other suppliers involved in fulfilling the order and providing the requested services, limited to the information necessary for the purposes described in this privacy notice.
4. METHODS OF DATA PROCESSING
Processing is carried out using electronic, digital and, where necessary, paper-based tools, through operations involving collection, recording, organization, structuring, storage, consultation, processing, use, communication, comparison, restriction, erasure and destruction, in accordance with the principles of lawfulness, fairness, transparency, data minimization and security, and with the adoption of appropriate technical and organizational measures pursuant to Article 32 GDPR.
The Controller may use automated security and anti-fraud systems to identify unusual transactions or behavior and to subject certain operations to further checks. As a rule, the Controller does not make decisions based solely on automated processing that produce legal effects or similarly significantly affect the Data Subject. However, payment providers and other third parties may independently carry out automated checks in accordance with their own privacy notices and terms, for example to authorize or decline a transaction.
5. DATA RETENTION
Personal data are retained for as long as necessary to pursue the purposes for which they are processed and, thereafter, for the periods required by applicable law or necessary to protect the Controller’s rights. In particular:
– data relating to orders, contracts, payments, refunds and related administrative and accounting formalities are retained for the period necessary to perform the relationship and, where required by civil, tax or accounting legislation, for up to ten years, without prejudice to any longer periods necessary in the event of claims or disputes;
– account-related data are retained until the account is deleted, without prejudice to the separate retention of data that must be kept to comply with legal obligations, execute orders, prevent abuse or protect rights;
– data relating to support requests are retained for the time necessary to handle the request and, if connected to an order or dispute, for the period applicable to the relevant relationship;
– data processed for newsletter and marketing purposes are retained until consent is withdrawn or the Data Subject objects, except for the minimum retention necessary to document the choices expressed;
– data collected through cookies and similar technologies are retained for the periods indicated in the Cookie Policy and consent settings;
– data processed to comply with legal obligations are retained for the period specified by the relevant legislation;
– data processed to establish, exercise or defend a right are retained for the time necessary to handle the relevant claim and, in any event, until the applicable limitation periods expire or any proceedings initiated are concluded.
6. DISCLOSURE OF DATA AND PARTIES INVOLVED IN PROCESSING
Personal data may be disclosed or made accessible, to the extent necessary for the purposes indicated above, to the parties described below.
6.1. Sugo S.n.c. di Federico Sacchi e Cristian Antolini
The Controller uses Sugo S.n.c. di Federico Sacchi e Cristian Antolini, with registered office in Crevalcore (BO), via Giacomo Matteotti 154, tax code and VAT number 03269341206, REA BO-505415 (hereinafter also “Sugo”), for activities related to the operational management of the Site and e-commerce services, including, depending on the assignment, order management, customer support, returns, refunds, technical and administrative support, and management of payment flows. When acting on behalf of Calzature Maxstyle Sas di Marzocchi Valeria & C., in accordance with the latter’s instructions and for purposes determined by the Controller, Sugo acts as a processor pursuant to Article 28 of the GDPR. Sugo is also appointed to receive and collect, in the name and on behalf of the Controller, amounts relating to purchases made on the Site and, where applicable, to manage the related refund flows. Only where and to the extent that, in relation to specific additional processing connected with banking relationships or payment accounts held in Sugo’s name, Sugo is required to process personal data to comply with legal obligations directly incumbent upon it, manage its own relationships with banks or payment service providers, or protect its own rights, independently determining the purposes and essential means of processing, does Sugo act as an independent controller, limited to those activities. Any such status does not extend to activities carried out exclusively on behalf of the Controller.
6.2. Shopify
The Site is built and hosted using the Shopify platform. In providing services to the Controller, Shopify generally processes customers’ personal data as a processor under the applicable Data Processing Addendum. In relation to certain consumer-facing services or advanced features, including services that may require Shopify Network Intelligence to be enabled, Shopify may also process certain data as an independent controller, under its own terms and privacy notices. More information about Shopify’s data processing and related privacy options is available at https://www.shopify.com/it/legal/privacy and, where applicable, at https://privacy.shopify.com.
6.3. Payment service providers, banking institutions and other recipients
Data may also be disclosed or made accessible to:
payment service providers, digital wallets, card networks, issuers, banks and payment institutions, including PayPal, Shopify Payments, Klarna or other entities available from time to time at checkout, which may process data as independent controllers for the purposes specified in their respective privacy notices;
– couriers, carriers, freight forwarders, logistics operators and pickup points, to the extent necessary for delivery, collection and the management of any returns;
– IT, hosting, security, technical support, customer care, communications, email, analytics, marketing, returns management and other service providers whose applications are integrated into the Website, acting as data processors or, where applicable, as independent controllers;
– accountants, consultants, lawyers, auditors and other professionals, to the extent necessary to carry out their respective assignments;
– judicial, administrative, tax and public security authorities or other public bodies, when disclosure is provided for or required by law;
– staff, collaborators and persons authorized by the Data Controller, within the scope of their respective duties and instructions.
The updated list of data processors may be requested from the Data Controller using the contact details provided in this privacy notice.
7. TRANSFERS OF DATA TO THIRD COUNTRIES
The use of Shopify and other technology, payment, analytics, marketing or support providers may involve the processing or transfer of personal data outside the European Economic Area. Shopify International Limited, as the contracting entity of reference for EMEA merchants, may rely on group companies and sub-processors established in different countries; Shopify also states that it currently stores some European merchants’ and customers’ data “at rest” in Europe, while continuing to carry out international transfers necessary to provide its services.
When data is transferred to countries that do not benefit from an adequacy decision by the European Commission, the transfer is carried out using appropriate safeguards under Articles 44 et seq. of the GDPR, such as, depending on the circumstances, Binding Corporate Rules, standard contractual clauses approved by the European Commission, and any additional measures required by applicable law. For transfers carried out by Shopify, please also refer to its Data Processing Addendum and the information on international transfers published by Shopify. Any other providers involved apply the transfer mechanisms specified in their respective privacy notices and terms.
8. DATA SUBJECT RIGHTS
In the cases and within the limits provided for under the GDPR, Data Subjects may exercise the following rights with respect to the Data Controller:
– obtain confirmation as to whether processing is taking place and access their personal data and the information provided for under Article 15 of the GDPR;
– obtain rectification of inaccurate data and completion of incomplete data under Article 16 of the GDPR;
– obtain erasure of personal data in the cases provided for under Article 17 of the GDPR;
– obtain restriction of processing in the cases provided for under Article 18 of the GDPR;
– receive, in the cases provided for under Article 20 of the GDPR, the data provided to the Data Controller in a structured, commonly used and machine-readable format, and transmit them to another controller;
– object, on grounds relating to their particular situation, to processing based on legitimate interests under Article 21 of the GDPR, and object at any time to processing for direct marketing purposes;
– withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
– not be subject, in the cases provided for under Article 22 of the GDPR, to decisions based solely on automated processing that produce legal effects or similarly significantly affect the individual;
– lodge a complaint with the competent supervisory authority. In Italy, the Italian Data Protection Authority can be reached via www.garanteprivacy.it.
Requests relating to processing carried out by Calzature Maxstyle Sas di Marzocchi Valeria & C. may be sent to the Data Controller at support@maxstyle.it. For processing carried out by third parties acting as independent controllers, including Shopify where it acts in that capacity, payment service providers and, solely with regard to any specific activities indicated in section 6.1, Sugo, Data Subjects may exercise their rights directly with the relevant controller in accordance with their respective privacy notices.
9. AMENDMENTS TO THE PRIVACY POLICY
The Data Controller reserves the right to amend or update this Privacy Policy to reflect changes in laws, the organization, technology, or the services used. The updated version will be published on the Website, with the date of the latest update indicated. If substantial changes require specific notice to Data Subjects, the Data Controller will take the information measures required by applicable law.