Data controller
Rumba S.R.L., Via Bonanno Pisano 50, 56126 Pisa (PI). P.IVA e C.F. 02560150506 (VAT number and tax code). REA PI-270603 (company register administrative index). Capitale sociale € 2.500,00 i.v. (share capital, fully paid up). Contact: info@ortolanodelvintage.com — PEC: rumbasrl@pec.cloud (certified email).
Data we collect
Account (if you register): email and account identifier; the credential is handled by the authentication provider and cannot be read by us. Orders: items, name, shipping address, email, telephone, any voucher, payment status and payment reference; tax details only if you ask for an invoice. “Your stall” video call: name, email, telephone, two sizes and preferences. Withdrawal and support: the data entered in the request. Newsletter: email and proof of consent. Card details do not pass through the site: they are entered on Nexi.
Why, and on what legal basis
To handle orders, shipping and video calls (performance of the contract). To issue invoices and keep the accounts (legal obligation). To send you the newsletter (your consent, which can be withdrawn at any time). To prevent fraud and keep the site working (our legitimate interest).
Who we disclose data to
Depending on the service actually used, the necessary data may be disclosed to Supabase (database and accounts), Nexi (payments), Resend (email and newsletter), Vercel (site hosting), the appointed carrier, and WhatsApp if you choose to write to us there. Each party’s privacy role depends on the service and on the applicable agreement: we do not automatically present them all as data processors. Sendcloud receives no data until the account, the agreements and the integration are activated and this notice is updated. We do not sell data for marketing.
Transfers outside the EU
Some providers may involve processing outside the European Economic Area. In that case the flow is activated only after checking the destination, the role, the agreement and a valid basis under Chapter V of the GDPR (Regulation (EU) 2016/679), such as an adequacy decision or the standard contractual clauses where applicable.
How long we keep them
Newsletter: until you unsubscribe, keeping the proof of consent where necessary. Orders, invoices and accounting records: for the period required by law, normally 10 years. Account: as long as it stays active or until you ask for it to be deleted, except for the data we have to keep by law or in order to protect a right. Support requests, withdrawal requests and security logs: only for as long as is necessary to handle them and to protect the parties.
Your rights
You can ask for access, rectification, erasure, restriction, objection and data portability, and you can withdraw a consent you have already given. Write to info@ortolanodelvintage.com: we reply without undue delay and at the latest within one month. If the request is complex, or if there are many of them, the reply may be extended by two months; in that case we inform you within the first month.
Complaint
If you believe we process your data improperly, you can turn to the Garante per la protezione dei dati personali, the Italian data protection authority (garanteprivacy.it).
Minors
The site is not aimed at anyone under 16 and we do not knowingly collect their data. If you think this has happened, write to us and we will delete it.
Updates
If anything changes we update this page; the date above shows the last update.
Write to me at info@ortolanodelvintage.com