1. Data Controller

The Data Controller for the processing of your personal data is:

2. Data We Collect

We collect the following categories of personal data:

Navigation Data

Data automatically collected when you visit our website: IP address, browser type, device information, pages visited, and access timestamps.

Data You Provide

• Orders: Name, email, phone, billing and shipping address
• Newsletter: Email address
• Contact form: Name, email, message content

Payment Data

Payment information (card numbers, PayPal credentials) is processed directly by our payment providers Stripe and PayPal. We do not store your full payment details on our servers.

3. Purpose and Legal Basis

We process your data for the following purposes:

4. Data Sharing

We do not sell or rent your personal data. We may share data with:

• Stripe Inc. - Card payment processing
• PayPal (Europe) - PayPal payment processing
• Shipping carriers - Order delivery
• Authorities - When required by law

5. International Data Transfers

Some of our service providers (Stripe, PayPal) may transfer data outside the European Economic Area (EEA), including to the United States.

These transfers are protected by appropriate safeguards including Standard Contractual Clauses (SCCs) approved by the European Commission and, where applicable, the EU-US Data Privacy Framework.

6. Data Retention

We retain your personal data only as long as necessary:

• Order data: 10 years (Italian tax law requirements)
• Newsletter subscribers: Until unsubscription
• Navigation logs: 12 months
• Contact inquiries: 24 months

8. Cookie Policy

We use only technical cookies that are strictly necessary for the website to function properly. These include:

• Session cookies for maintaining your login state
• Shopping cart cookies to remember your selections
• Security cookies for CSRF protection
• Payment cookies set by Stripe and PayPal — only on the checkout page, strictly necessary to process your transaction
• Analytics & marketing cookies (Google Analytics 4 by Google LLC; Meta Pixel by Meta Platforms, Inc.) — Google Analytics uses Consent Mode v2 and does not collect personal data until you give consent; Meta Pixel is only activated after your explicit consent, to show relevant ads and measure campaign performance

Technical cookies are used without consent, as strictly necessary. Analytics and marketing cookies (Google Analytics 4, Meta Pixel) are only fully activated after your explicit consent via the cookie banner. You can withdraw consent at any time by clearing your browser's local storage.

9. Security Measures

We implement appropriate technical and organizational measures to protect your data:

• HTTPS encryption for all data transmission
• Secure password hashing (bcrypt)
• Regular security updates and monitoring
• Limited access to personal data on a need-to-know basis

10. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be published on this page with an updated revision date. For significant changes, we may notify you via email.

California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know - Request disclosure of personal information collected, used, and shared
• Right to Delete - Request deletion of your personal information
• Right to Correct - Request correction of inaccurate information
• Right to Opt-Out - Opt-out of the sale or sharing of personal information
• Non-Discrimination - We will not discriminate against you for exercising your rights

To exercise your California privacy rights, contact us at info@carbontronic.com with the subject "California Privacy Request".

UK Residents

If you are a resident of the United Kingdom, your personal data is protected under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

You have the same rights as EU residents outlined in Section 7 above. The supervisory authority for the UK is the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Helpline: +44 303 123 1113

Asia-Pacific Residents

We respect privacy laws across the Asia-Pacific region. Depending on your location, you may have rights under:

• Japan: Act on Protection of Personal Information (APPI)
• South Korea: Personal Information Protection Act (PIPA)
• Singapore: Personal Data Protection Act (PDPA)
• Australia: Privacy Act 1988

These laws generally provide rights to access, correct, and delete your personal data. For requests, contact us at info@carbontronic.com.

Cross-border transfers: By using our services, you consent to the transfer of your data to Italy and other countries where our service providers operate, subject to appropriate safeguards.