Privacy policy

PRIVACY NOTICE

pursuant to Articles 13 and 14 of EU Regulation 2016/679

Website notoriousbrand.it

Updated on: 03 June 2026

This Privacy Notice is provided pursuant to Articles 13 and 14 of EU Regulation 2016/679 ("GDPR") and describes how the personal data of users who access, browse and purchase products through the website https://notoriousbrand.it/, hereinafter also referred to as the "Site" or "Platform", are processed.

The Data Controller is:

NOTORIOUS DI A.G.S.
VAT No. 05778780287
Registered office: Via G. Mazzini, 53, 35030 Rubano, PD, Italia
Contact e-mail: help@notoriousbrand.it

The Controller informs that users' personal data will be processed using manual, electronic, IT and telematic tools, with logic strictly related to the purposes indicated in this notice and, in any case, in such a way as to guarantee the security, confidentiality, integrity and availability of the personal data.

1. Nature of the data processed

1.1 Identification and contact data

Browsing the Site, registering an account, sending requests via contact forms and purchasing products may involve the processing of data capable of directly or indirectly identifying a natural person.

By way of example, the Controller may process: first and last name; e-mail address; telephone number; shipping address; billing address; city, postcode, province, country; tax code and/or VAT number, where necessary for tax or invoicing purposes; data relating to orders placed; data relating to returns, refunds, complaints and customer service; any data voluntarily entered by the user in communications sent to the Controller. 

The Site does not require the user to provide data belonging to the special categories referred to in Article 9 GDPR, such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health, sex life or sexual orientation.

Should the user spontaneously communicate such data through messages, requests or communications sent to the Controller, the Controller may delete them, where not necessary, or process them exclusively to the extent that this is indispensable for handling the user's request and in compliance with applicable law.

1.2 Browsing data

The IT systems and software procedures used to operate the Site acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols.

This category includes, by way of example: IP addresses; domain names of the devices used by users; URI/URL addresses of the resources requested; time of the request; method used to submit the request to the server; size of the file obtained in response; numerical code indicating the status of the server's response; parameters relating to the user's operating system, browser and IT environment. 

These data are used to allow browsing of the Site, to obtain anonymous statistical information on its use, to check that it is functioning correctly and to ascertain liability in the event of hypothetical computer crimes or misuse.

1.3 Cookies and tracking tools

The Site may use technical, analytical, functional, advertising and/or marketing cookies and tracking tools.

For more information on the type of cookies used, their purposes and how to manage or withdraw consent, the user is invited to consult the specific Cookie Policy available on the Site.

1.4 Data provided voluntarily via contact forms or e-mail communications

The optional, explicit and voluntary sending of messages to the e-mail addresses indicated on the Site, as well as the completion of any contact forms, entails the acquisition of the data provided by the user, including the sender's e-mail address and any other personal data included in the communication.

These data are processed exclusively to respond to the user's requests, provide assistance, manage commercial or pre-contractual communications and follow up on any activities requested.

1. Data relating to registration and the purchase of products

In order to allow the user to register, place orders, purchase products, receive the shipment, request assistance and manage any returns or refunds, the Controller may process: first and last name; e-mail address; telephone number; shipping address; billing address; data relating to the product purchased; order number; purchase history; payment information; data necessary to manage delivery; data necessary to manage returns, replacements and refunds; any communications exchanged with customer service. 

Payment data are generally not processed in full by the Controller, but by the payment service providers used on the Site, which operate in accordance with their respective privacy notices and security measures.

2. Purposes of processing

Users' personal data may be processed for the following purposes.

2.1 Browsing and operation of the Site

Browsing data are processed to allow access to the Site, ensure its correct functioning, improve IT security, prevent abuse and obtain statistical information on the use of the Platform.

2.2 Management of user requests

Data provided via e-mail, contact forms, chat, support channels or other communication tools are processed to respond to user requests, provide information on products, and manage complaints, requests for assistance and questions relating to orders, shipments, returns and refunds.

2.3 Account registration

Where the Site allows the creation of a personal account, the user's data will be processed to allow registration, access to the reserved area, profile management, viewing of orders and use of the related features.

2.4 Order management and sale of products

The user's personal data are processed to allow the purchase of the products available on the Site, the confirmation of the order, the management of payment, the preparation of the shipment, the sending of communications relating to the purchase, the delivery of the products and the management of any related obligations.

2.5 Shipping, delivery and logistics model, including outside the EU

The Controller processes the user's data to manage the shipping and delivery of the products purchased.

The user acknowledges that the Controller may also operate through an online sales logistics model with direct shipping from suppliers, logistics partners or warehouses located also outside the European Union, including China.

For this reason, the data strictly necessary for shipping, such as first name, last name, delivery address, telephone number, e-mail, order information and data necessary for delivery, may be communicated to suppliers, logistics partners, couriers, postal operators, customs operators or other parties involved in the order fulfilment chain.

Where this involves a transfer of personal data to countries located outside the European Economic Area, the transfer will take place in compliance with Articles 44 et seq. GDPR, by means of appropriate safeguards, such as adequacy decisions of the European Commission, Standard Contractual Clauses or other instruments provided for by applicable law.

2.6 Management of returns, refunds, complaints and after-sales assistance

The user's personal data may be processed to manage requests for withdrawal, return, product exchange, refund, complaints, legal guarantee, disputes regarding delivery or other requests for after-sales assistance.

In such cases, the Controller may also process photographs of the product, packaging, shipping labels, proof of delivery, return shipping receipts and any other information necessary to verify the user's request.

2.7 Tax, accounting and administrative obligations

The user's personal data may be processed to fulfil obligations under tax, accounting, administrative and civil law, including the management of documentation relating to orders, payments, invoices, refunds and obligations connected with online sales.

2.8 Newsletters and commercial communications

Where the user gives their consent, personal data may be processed for sending newsletters, promotional communications, commercial offers, product updates, marketing campaigns, discounts, promotions and brand initiatives.

Communications may be sent via e-mail, SMS, messaging systems or other digital tools, within the limits of the consent given by the user.

The user may withdraw their consent at any time by using the unsubscribe link contained in the communications received or by writing to the Controller.

2.9 Marketing, remarketing and personalised advertising

Subject to the user's consent, the Controller may use cookies, pixels, tags and other tracking tools for the purposes of marketing, remarketing, measuring advertising campaigns and sending personalised advertisements, including through third-party platforms such as, by way of example, Meta, Google, TikTok, Shopify or other providers of advertising and analytics services.

The user may manage their preferences via the cookie banner or the tools made available by the Site and by the individual third-party providers.

2.10 Protection of the Controller's rights

Personal data may be processed to establish, exercise or defend a right of the Controller in court or out of court, as well as to prevent fraud, abuse, unlawful use of the Site, payment disputes, chargebacks or breaches of the Terms and Conditions.

3. Legal bases for processing

Personal data are processed on the basis of the following legal bases.

3.1 Performance of a contract or pre-contractual measures

The processing of data relating to orders, payments, shipping, delivery, account registration, returns, refunds and customer service is necessary for the performance of the sales contract or of pre-contractual measures requested by the user.

3.2 Compliance with legal obligations

The processing of personal data may be necessary to fulfil tax, accounting, administrative, civil, customs or other obligations provided for by applicable law.

3.3 Consent of the data subject

Processing for the purposes of newsletters, direct marketing, promotional communications, advertising profiling, remarketing and the use of non-technical cookies takes place on the basis of the data subject's consent, where required by applicable law.

Consent is free, specific, informed and may be withdrawn at any time.

1. Legitimate interest of the Controller

The Controller may process personal data on the basis of its legitimate interest where processing is necessary to: ensure the security of the Site; prevent fraud or misuse; manage disputes, complaints or challenges; establish, exercise or defend a right; improve the services offered, within the limits permitted by law; send communications relating to products or services similar to those already purchased, where permitted by law and unless the user objects. 

4. Methods of processing

Personal data are processed using manual, electronic, IT and telematic tools, according to logic strictly related to the purposes indicated in this notice.

The Controller adopts appropriate technical and organisational measures to protect personal data against loss, unauthorised access, unlawful use, disclosure, alteration or unauthorised destruction.

The data will be processed exclusively by persons authorised by the Controller or by third parties providing services necessary for the management of the Site, orders, payments, shipments, marketing and customer service.

5. Categories of recipients of personal data

The user's personal data may be communicated to the following categories of parties:staff, collaborators and persons authorised by the Controller; IT service providers; hosting providers; e-commerce platforms; cloud service providers; payment service providers; banks and financial intermediaries; couriers, forwarders, logistics and postal operators; suppliers, warehouses and logistics partners located also abroad; tax advisors, accountants, legal advisors and other professionals; companies providing customer care services; e-mail marketing and newsletter platforms; advertising and analytics platforms; public, administrative, tax, customs or judicial authorities, in the cases provided for by law. 

The updated list of any Data Processors appointed pursuant to Article 28 GDPR is available from the Controller and may be requested by writing to the e-mail address indicated in this notice.

Personal data will not be disseminated to unspecified recipients.

6. Payment providers

To manage payments made through the Site, the Controller may use third-party providers such as, by way of example, Shopify Payments, PayPal, Stripe, credit cards, Apple Pay, Google Pay, Shop Pay or other payment systems available at checkout.

These parties may process the user's personal data as independent data controllers or, depending on the case, as data processors, in accordance with their respective privacy notices.

The Controller does not store the user's payment card data in full; such data are managed by the payment providers in accordance with industry security standards.

7. Couriers, forwarders, suppliers and logistics partners

In order to fulfil orders and deliver the products purchased, the Controller may communicate the user's personal data to couriers, forwarders, logistics operators, postal operators, suppliers, warehouses and commercial partners.

In view of the logistics model used, some products may be shipped directly from suppliers or warehouses located outside the European Union, including China.

In such cases, the data necessary for shipping and delivery may be transferred to the foreign parties involved in the logistics chain, to the extent strictly necessary to perform the sales contract and deliver the product to the user.

8. Place of processing

Personal data are processed at the Controller's premises, at the servers and technical infrastructures used to operate the Site and at the premises of the technical, commercial and logistics providers and partners involved in the processing.

The data may also be stored and processed through cloud services, e-commerce platforms, payment systems, marketing tools and logistics services located in Italy, in the European Union or in non-EU countries, in compliance with applicable law.

9. Transfer of data to non-EU countries

The use of e-commerce platforms, payment tools, cloud services, marketing tools, international couriers, logistics providers and partners located abroad may involve the transfer of personal data outside the European Economic Area.

In particular, due to the sales and shipping model used by the Controller, the data necessary for order fulfilment and product delivery may be communicated to suppliers, warehouses or logistics partners located also in China or in other non-EU countries.

The transfer of data outside the EU takes place in compliance with Articles 44 et seq. GDPR and, where necessary, on the basis of appropriate safeguard instruments, such as: adequacy decisions of the European Commission; Standard Contractual Clauses approved by the European Commission; supplementary technical, organisational and contractual measures, where necessary; derogations provided for by Article 49 GDPR, where the transfer is necessary for the performance of the contract concluded between the user and the Controller or for the implementation of pre-contractual measures taken at the user's request. 

10. Data retention

Personal data will be retained for the time strictly necessary to achieve the purposes for which they were collected.

Once the retention period has expired, the data will be deleted, anonymised or aggregated so as not to allow identification of the data subject.

11. Obligatory or optional nature of providing data

Providing browsing data is necessary to allow access to and operation of the Site.

Providing the data necessary for registration, purchase, payment, shipping, delivery and the management of returns or refunds is necessary to conclude and perform the sales contract.

Any refusal to provide such data may make it impossible to register, place orders, receive the products purchased, obtain assistance or use the services requested.

Providing data for the purposes of marketing, newsletters, advertising profiling and non-technical cookies is optional. Failure to give consent does not affect the ability to browse the Site or purchase products, except for the impossibility of receiving promotional communications or personalised content.

12. Rights of the data subject

The user, as data subject, may at any time exercise the rights provided for by Articles 12-22 GDPR.

In particular, the user has the right to:

1. obtain confirmation as to whether or not personal data concerning them are being processed; 

2. access their personal data; 

3. obtain the rectification of inaccurate data; 

4. obtain the completion of incomplete data; 

5. obtain the erasure of data in the cases provided for by law; 

6. obtain the restriction of processing; 

7. receive their data in a structured, commonly used and machine-readable format; 

8. object to processing in the cases provided for by law; 

9. withdraw the consent given, without affecting the lawfulness of processing based on consent before its withdrawal; 

10. not be subject to decisions based solely on automated processing, including profiling, where they produce legal effects or significantly affect the person. 

To exercise their rights, the user may contact the Controller by writing to:

help@notoriousbrand.it

The Controller undertakes to respond to requests within the time limits provided for by applicable law.

13. Complaint to the Italian Data Protection Authority (Garante per la protezione dei dati personali)

Should the user consider that the processing of their personal data is in breach of applicable law, they have the right to lodge a complaint with the Garante per la protezione dei dati personali.

The user remains free to apply to the competent judicial authority.

14. Security of personal data

The Controller adopts technical and organisational measures appropriate to the risk in order to protect the personal data processed against unauthorised access, loss, destruction, disclosure, alteration or unlawful processing.

These measures include, where applicable, authentication systems, security protocols, access restrictions, backups, software updates, IT protection tools and internal procedures for the management of personal data.

Despite the adoption of appropriate security measures, no IT system can be considered completely immune from risk. The user is therefore invited to use secure credentials, not to share their access details and to promptly report any unauthorised use of their account.

16. Changes to the notice

The Controller reserves the right to modify, update or supplement this Privacy Notice at any time, including as a result of regulatory changes, technical updates, changes to the services offered or changes to the organisational and logistics model.

Changes will be published on the Site and will be effective from the time of publication.

The user is invited to consult this page regularly to check for any updates.

17. Contacts

For any request relating to the processing of personal data, the exercise of privacy rights or this Notice, the user may contact the Controller at the following contact details:

E-mail: help@notoriousbrand.it
Office: Via G. Mazzini, 53, 35030 Rubano, PD, Italia