Privacy policy.What we collect, why, with whom, and what you can ask us.

Data controller

Rumba S.R.L., Via Bonanno Pisano 50, 56126 Pisa (PI). P.IVA e C.F. 02560150506 (VAT number and tax code). REA PI-270603 (company register administrative index). Capitale sociale € 2.500,00 i.v. (share capital, fully paid up). Contact: info@ortolanodelvintage.com — PEC: rumbasrl@pec.cloud (certified email).

Data we collect

Account (if you register): email and account identifier; the credential is handled by the authentication provider and cannot be read by us. Sign-in with Google (if you choose “Continue with Google”): Google passes on your name, email address and profile photo (scopes openid, email, profile) so that your account can be created or recognised; your Google password never reaches the site. The site uses the name and the email; the photo stays in the account data held by the authentication provider and is neither shown nor used. Legal basis: performance of the service you ask for, that is the account. For its own sign-in Google is an independent data controller; you can disconnect the access from the settings of your Google account (myaccount.google.com). Orders: items, name, shipping address, email, telephone, any voucher, payment status and payment reference; invoice details (the person invoiced, the billing address and the Italian tax code if the billing address is in Italy, or company name, VAT number and SdI code or PEC): we issue an invoice for every order of items and crates, so we ask for them with every order to meet the tax obligation that comes with it; the deposit for the “Your stall” video call does not ask for them. “Your stall” video call: name, email, telephone, two sizes and preferences. Withdrawal and support: the data entered in the request. Newsletter: email and proof of consent. Card details do not pass through the site: they are entered on Nexi.

Rummage: the preferences you choose are sizes, categories, conditions, decades, department and maximum price. You can add optional measurements in cm: chest, shoulders, waist, hips, length, sleeve, rise and leg.

If you use Rummage without an account, preferences, discarded items, held items and undo history are saved in the browser’s memory. To search the catalogue, even without an account, we send the server the filters and measurements you entered: this request does not create an account profile.

When you sign in, preferences are saved to your account so you can use them on other devices; measurements are saved to the account if saving is available, otherwise the site tells you they stay on the device. Held items are synced with the account; guest held items are transferred only by your explicit choice. Account alerts keep the choices you make for a single item: price, availability or the item being sold. The account email may be used for requested notifications; a saved choice is not proof of sending or delivery of an email and is not consent to the newsletter or other marketing.

Why, and on what legal basis

To handle orders, shipping and video calls (performance of the contract). To issue the invoice for every order and keep the accounts (legal obligation: we issue an invoice for every order of items and crates, and tax law sets what it must contain and how it must be kept). To send you the newsletter (your consent, which can be withdrawn at any time). To prevent fraud and keep the site working (our legitimate interest).

Using the filters in Rummage, saving preferences and held items to the account and managing requested alerts are part of the service you ask for (performance of the service, as with the account). Authorised staff may consult these data to help you use the service.

Who we disclose data to

Depending on the service actually used, the necessary data may be disclosed to Supabase (database and accounts), Nexi (payments), Resend (email and newsletter), Vercel (site hosting), the appointed carrier, and WhatsApp if you choose to write to us there; the Italian Revenue Agency (Agenzia delle Entrate), through the e-invoicing exchange system (SdI), for the electronic invoice of every order. Each party’s privacy role depends on the service and on the applicable agreement: we do not automatically present them all as data processors. Sendcloud receives no data until the account, the agreements and the integration are activated and this notice is updated. We do not sell data for marketing.

Authorised staff have read-only access to account preferences, held items and requested alerts in the customer record in the Retrobottega, only for support. This access does not identify guests or allow staff to change these choices. We do not use these choices to infer a behavioural profile.

Transfers outside the EU

Some providers may involve processing outside the European Economic Area. In that case the flow is activated only after checking the destination, the role, the agreement and a valid basis under Chapter V of the GDPR (Regulation (EU) 2016/679), such as an adequacy decision or the standard contractual clauses where applicable.

How long we keep them

Newsletter: until you unsubscribe, keeping the proof of consent where necessary. Orders, invoices with the invoice details, and accounting records: for the period required by the Italian Civil Code and tax law, normally 10 years. Account: as long as it stays active or until you ask for it to be deleted, except for the data we have to keep by law or in order to protect a right. Support requests, withdrawal requests and security logs: only for as long as is necessary to handle them and to protect the parties.

Preferences, held items and alerts saved to the account are account data and follow the same retention policy described above. You can edit preferences and remove held items and alerts; to request erasure of account data, write to info@ortolanodelvintage.com, under the rights and limits stated in this notice. We handle the request within the timeframes and limits explained in this notice under “Your rights”.

Signing out does not erase choices kept in the browser. You can remove local copies in the browser settings: this is separate from a request to erase account data.

Your rights

You can ask for access, rectification, erasure, restriction, objection and data portability, and you can withdraw a consent you have already given. Write to info@ortolanodelvintage.com: we reply without undue delay and at the latest within one month. If the request is complex, or if there are many of them, the reply may be extended by two months; in that case we inform you within the first month.

Complaint

If you believe we process your data improperly, you can turn to the Garante per la protezione dei dati personali, the Italian data protection authority (garanteprivacy.it).

Minors

The site is not aimed at anyone under 16 and we do not knowingly collect their data. If you think this has happened, write to us and we will delete it.

Updates

If anything changes we update this page; the date below shows the last update.

Last revised

11 October 2026.