PRIVACY POLICY

1. Data controller

GARCIA NICOLAS MAURICIO (trading as “GARCIAS”), a sole proprietorship registered in Italy, with registered address at Via Porro Lambertenghi Luigi 5, 20159 Milan (MI), Italy. VAT number IT12718870962. Contact: info@garcias.it / Certified email (PEC): garcias@pec.it.

2. Data we collect

• Identification and contact data: first and last name, shipping/billing address, email, phone number.
• Account data: username, order history, size/product preferences.
• Payment data: handled directly by payment providers (Shopify Payments and third parties such as PayPal, Klarna, Apple Pay, Google Pay, etc.); GARCIAS does not store full card details.
• Browsing data: IP address, device and browser type, pages visited, via cookies and similar technologies.
• Communications: messages sent through the contact form or email.
• Marketing data: email address for the newsletter, if the Customer has voluntarily subscribed.

3. Purposes and legal basis for processing

• Managing orders, payments, shipping, and returns: performance of the sales contract (Art. 6(1)(b) GDPR).
• Compliance with legal and tax obligations: legal obligation (Art. 6(1)(c) GDPR).
• Customer support and warranty management: contract performance / legitimate interest.
• Sending marketing communications and newsletters: consent of the data subject (Art. 6(1)(a) GDPR), revocable at any time.
• Site improvement, analytics, and fraud prevention: legitimate interest (Art. 6(1)(f) GDPR).
• Non-essential cookies (analytics, marketing): consent, managed through the Site's cookie preference panel.

4. Recipients of data

• Shopify Inc. (the e-commerce platform hosting the Site and processing orders).
• Payment providers: Shopify Payments, PayPal, Klarna, Apple Pay, Google Pay, among others shown at checkout.
• Shipping carriers and logistics companies responsible for delivering orders.
• Email marketing and customer support service providers.
• Public authorities, where required by law.
• GARCIAS does not sell Customers' personal data to third parties.

5. International transfers

Some providers (such as Shopify) may process data outside the European Economic Area, in particular in the United States. In such cases, the transfer relies on the Standard Contractual Clauses approved by the European Commission or another valid transfer mechanism under the GDPR.

6. Retention period

Data is retained for as long as the contractual relationship with the Customer lasts and, thereafter, for the periods required under Italian tax and commercial law (generally 10 years for accounting records). Data used for marketing is retained until the data subject withdraws consent.

7. Data subject rights

Under the GDPR, the Customer may at any time exercise the rights of access, rectification, erasure, objection, restriction of processing, and data portability, and may withdraw consent previously given, by writing to info@garcias.it. The Customer also has the right to lodge a complaint with the competent supervisory authority, in Italy the Garante per la Protezione dei Dati Personali (www.garanteprivacy.it).

8. Cookies

The Site uses first-party and third-party cookies, necessary for its operation and, subject to consent, for analytics and marketing purposes (including tools such as those from Shopify, Meta/Facebook, and Google). The Customer can manage cookie preferences through the Site's banner or their browser settings.

9. Minors

The Site is not directed at persons under 16 years of age. We do not knowingly collect data from minors without parental or guardian consent.

10. Security

GARCIAS implements reasonable technical and organizational measures to protect personal data against unauthorized access, loss, or alteration.

11. Changes to this Policy

This Policy may be updated periodically. Users are encouraged to review it regularly. The “last updated” date indicates the current version in force.

12. Contact

For any questions about this Policy or to exercise your rights: info@garcias.it.