Privacy policy

Data controller

MIMA & LULÙ 7 DI LUCCI YLENIA (Mima&Lulù⁷) — P.IVA 16874081009 — email mimaelulu@gmail.com — PEC lucciylenia@pec.it

What we collect

We only collect what is needed to make and ship an order:

• contact details: first and last name, email, phone if you give it
• shipping details: address, postcode, city, country
• Italian tax code, requested only for shipments to Italy and only to issue the invoice
• the content of the customisations you ask for, including images you upload
• technical browsing data strictly necessary to run the site

Payment data

Payments are handled by Stripe Payments Europe Ltd. Card details are entered on Stripe's pages and never pass through or rest on our systems. We only receive the payment outcome and a transaction identifier.

Why we process it, and on what legal basis

• performance of the contract: handling the order, the making, shipping and support (Art. 6.1.b GDPR)
• legal obligations: invoicing and retention of accounting records (Art. 6.1.c GDPR)
• legitimate interest: site security and abuse prevention (Art. 6.1.f GDPR)

Who we share it with

Data is accessible only to us and to the suppliers that let us operate, acting as processors:

• Supabase — database and authentication
• Stripe — payment collection
• Brevo — transactional email delivery
• the courier handling the shipment
• our accountant, for tax obligations

Transfers outside the European Union

Some suppliers may process data outside the European Economic Area. Where that happens, the transfer relies on the Standard Contractual Clauses approved by the European Commission or on an adequacy decision.

How long we keep it

• order and invoice data: 10 years, as tax law requires
• images and text of custom requests: up to 24 months after the request is closed
• account data: for as long as the account stays active

Your rights

You may at any time request access, rectification, erasure, restriction, data portability and object to processing by writing to mimaelulu@gmail.com. We reply within one month.

If you believe the processing breaches the Regulation you may lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

Minors

This site is not aimed at children under 14. If you are a minor, please ask whoever holds parental responsibility before buying.