Last updated: 04/11/2026

1. Controller and contact

The controller is SWEET POSITANO S.r.l., based at Viale Pasitea 160-162 - 84017 Positano (SA), tax/VAT number 06256920650, email info@sweetpositano.it. This notice covers www.sweetpositano.it purchases and communications with the store. No Data Protection Officer (DPO) has been appointed.

2. Data, purposes and legal grounds

Orders, payments and delivery. We process identification/contact details, billing/delivery addresses, purchased items, amounts and transaction references to enter into and perform purchases and manage delivery, returns, warranties and assistance (GDPR Article 6(1)(b)). Accounting documents are processed to fulfil legal duties (Article 6(1)(c)); records relevant to disputes are processed to establish, exercise or defend legal claims (legitimate interest, Article 6(1)(f)).

Customer accounts. Email addresses, profile details, authentication information managed by the platform and associated orders are processed to provide the requested service (Article 6(1)(b)). Creating an account does not subscribe you to the newsletter.

Enquiries and assistance. We process emails, phone numbers, messages and attachments received through forms, email or WhatsApp to respond. The grounds are pre-contractual steps or contract performance (Article 6(1)(b)), or our legitimate interest in answering other enquiries (Article 6(1)(f)). Email, including order notifications, is managed through Aruba. WhatsApp messages remain on the devices and account used by the controller. We do not use chat for promotional campaigns. Please do not send sensitive information or documents unnecessary for your enquiry.

Newsletter. With consent (Article 6(1)(a)), we use your email and optional form information to send updates and offers through Brevo. Withdraw consent using the unsubscribe link in each newsletter or by contacting us. Starting a chat or making a purchase does not automatically constitute newsletter consent.

Operation, security and preferences. The website and integrated services process technical information, such as IP addresses, browser, device, session and operational events, to deliver requested functions and protect the service. The grounds are service performance (Article 6(1)(b)), legitimate interests in security and preventing abuse (Article 6(1)(f)), and applicable legal duties (Article 6(1)(c)). Legitimate interests are assessed taking account of users’ rights. Optional analytics and marketing tools follow consent choices; see our Cookie Policy.

Geolocation and accessibility. Orbe Geolocation uses technical connection information and language/market preferences to recommend a store version and remember choices. Avada Accessibility provides display and reading adjustments. Reports submitted through the widget may include email, message and date, with internal notes to handle the enquiry. Requested functions rely on Article 6(1)(b); other issue handling relies on our legitimate interest in resolving reported problems (Article 6(1)(f)). Optional tracking features require the relevant choice.

Consent. CookieYes manages cookie preferences. Information needed to respect and document choices is processed to fulfil data protection and proof-of-consent duties (GDPR Articles 6(1)(c) and 7).

3. Required information

Information requested for orders, payment, delivery and invoicing is necessary to perform purchases. Without it we may be unable to provide the service. Newsletters and optional tools are voluntary: refusing them does not prevent normal purchases, although some optional features may be unavailable.

4. Recipients and services

The controller, authorised persons and providers access information as needed for their activities:

  • Shopify: ecommerce platform, accounts and orders; Shopify Payments, Satispay and Klarna, according to the selected method, for payments.
  • Mail Boxes Etc., the contracted centre, MBE eShip and appointed carriers: shipping management and delivery.
  • Brevo: subscriptions, newsletters and unsubscribes; Aruba: email and order notifications.
  • Ctx / Chatix by Softpulse Infotech: chat access widget; WhatsApp: messaging service.
  • Orbe Geolocation by MUSHDESK, S.L.: geolocation and preferences; Avada Accessibility: accessibility and issue reports; CookieYes: preferences and consent records.
  • Shopify Translate & Adapt: content translation/adaptation; accounting, tax and legal advisers and competent authorities where necessary or legally required.

Providers act as processors on our behalf or as independent controllers for their own processing, according to the service and applicable contracts. Payment providers may conduct fraud prevention or assessments required for the requested method, as explained in their notices. Information is not made public.

The store does not keep exported customer lists outside Shopify and Brevo. Necessary information is nevertheless retained on the shipping platform and in emails and assistance messages.

5. Locations and transfers

International services may process or access information outside the European Economic Area. Shopify’s processing agreement and transfer documentation describe safeguards for different flows, including adequacy decisions, binding corporate rules and standard contractual clauses.

Brevo states that its databases are hosted in France, Germany and Belgium; Aruba states that its main email services use its Italian data centres. These statements do not mean that every activity of those providers occurs exclusively in those countries.

Ctx’s notice mentions transfers outside Europe, including Canada and the United States. WhatsApp’s EEA notice explains its international processing. We are reviewing service-specific documentation on countries, subprocessors and safeguards for other integrated-app flows; this section will be updated when those details are confirmed. Contact us for the available details and documented safeguards.

6. Retention

We use different periods according to purpose:

  • Accounting: records covered by Italian Civil Code Article 2220 for ten years from the last entry; invoices and tax documents for applicable periods, including extensions for assessments or disputes.
  • Orders and contractual assistance: for fulfilment, returns and warranties; afterwards, only documents needed for legal duties or claims within relevant limitation periods. Ordinary contractual claims generally have a ten-year limitation period, with the starting event and any interruptions assessed for the particular right.
  • Accounts: for the requested service until closure; order records subject to separate duties are kept separately. Closure and erasure requests are assessed within GDPR time limits.
  • General enquiries and accessibility reports: until resolution and for no more than six additional months, except documents relevant to orders, duties or disputes.
  • Newsletter: until withdrawal and no longer than 24 months from consent or explicit renewal. Opening an email does not renew consent. After unsubscribing, the address may remain on the suppression list while lists or synchronisations could reimport it; necessity is reviewed every six months.

Consent records, technical logs and backups are separate from operational records. We are checking their retention and deletion periods with providers; no uniform period has currently been confirmed for these records. Deletion through an interface does not by itself establish removal from all technical copies. Confirmed information will be added to this page.

Cookie lifetimes appear in the inventory referenced by the Cookie Policy and do not necessarily equal retention of information already collected. Only relevant records are retained for disputes or specific legal duties, with restricted access.

7. Your rights

Where the GDPR provides, you may request access, rectification, erasure, restriction and portability. You may object to legitimate-interest processing on grounds relating to your particular situation and at any time to direct marketing. You may withdraw consent without affecting earlier processing.

Contact info@sweetpositano.it. We normally respond within one month, subject to GDPR extensions, which will be explained to you. You may complain to the Italian data protection authority or another competent authority without contacting the controller first.

8. Updates

This version reflects currently available information. Technical checks concerning providers and integrated features are ongoing and will be reflected in updates. Open checks do not limit your rights. Use the privacy contact to ask about their status or your information.