Privacy policy

Last updated: September 25, 2026

This policy describes how personal data is processed by the Borromini Firenze store, operated by R.V.M. S.r.l., the data controller. It covers browsing, purchases, accounts and communications with us. Reading this policy or simply browsing does not constitute consent to marketing or non-essential tracking.

Personal Information We Collect or Process

  • Contact and account information: name, email, telephone number, billing and delivery addresses, account identifiers and preferences needed to manage the account.
  • Purchases and payments: products viewed or added to your cart, orders, returns, amounts, payment method, status and transaction references. For card payments made through the online checkout, full card details are processed by the payment services used. In the order details, Shopify may make partial information available to us, such as the card network, the final digits of the card or wallet payment identifier, and verification results. It does not make the full card number or CVV/CVC security code available to us.
  • Support and withdrawal: messages, withdrawal statements, order number, affected products, notes, receipts and information needed to document your request. The order date on the withdrawal form is optional.
  • Browsing: IP address, device and browser information, usage events and tracker identifiers, according to the features used and your preferences.
  • Consent and reviews: communication preferences, objections, content you choose to publish and associated information.

Personal Information Sources

We receive information directly from you when you purchase, use your account, submit a form or contact us; from store systems during browsing; and from providers involved in orders, support and communications, for example to confirm a payment, delivery or preference. Information collected through optional trackers depends on your choices.

How We Use Your Personal Information

  • Orders and accounts: managing your cart, purchase, payment, delivery, returns, warranties and service communications; performance of a contract or steps you request before contracting, Article 6(1)(b) GDPR. Without necessary information we may be unable to fulfil the order.
  • Support and withdrawal: answering requests, recording statements and sending receipts; Article 6(1)(b), and Article 6(1)(c) for applicable legal obligations.
  • Accounting and compliance: administrative, tax and other legally required activities; Article 6(1)(c).
  • Security and protection of rights: preventing fraud and misuse and handling disputes; legitimate interests in security and defending rights, Article 6(1)(f), with due regard for your rights.
  • Operational reports: analysing orders and store performance using relevant and, where possible, aggregated information; legitimate interests in organising our business, Article 6(1)(f).
  • Newsletter: email news and promotions with consent, Article 6(1)(a) GDPR and Article 130 of the Italian Privacy Code. Subscribing is optional; purchasing or creating an account does not subscribe you.
  • Voluntary reviews: managing them, checking their connection to purchases and publishing them; legitimate interests in providing reliable information, Article 6(1)(f). Do not include unnecessary personal details in public text.
  • Non-essential analytics and personalised advertising: for functions using non-essential trackers, consent through privacy preferences, Article 6(1)(a) GDPR and Article 122 of the Italian Privacy Code, separate from newsletter consent.

Reminder for an unfinished checkout

With your consent to receive email marketing, R.V.M. S.r.l. may use your email address and details of a checkout you started but did not complete, including the items added, to send you messages with a link to resume your purchase. The legal basis for these messages is consent under Article 6(1)(a) of the GDPR and Article 130 of the Italian Privacy Code. Making a purchase, creating an account or entering an email address at checkout does not, by itself, subscribe you to marketing communications.

From September 25, 2026 at 13:30 Italian time (Europe/Rome; 11:30 UTC), for new customer profiles, checkouts and associated abandonment events recorded from that time, we may also send people who have not subscribed to email marketing one strictly functional reminder to resume that checkout. This service is limited to checkouts with both billing and delivery addresses in Italy; missing, foreign or conflicting country details are excluded. We use the email address and checkout details to provide a link to the process already started, without additional discounts, recommendations for other products, artificial urgency or subsequent reminders for the same checkout. Profiles and checkouts created before the service starts are excluded. Before sending, we recheck purchase status, previous reminders, communication preferences and recorded objections. This reminder does not subscribe you to our newsletter.

The legal basis for this single functional reminder is our legitimate interest in enabling you to resume the checkout you started, under Article 6(1)(f) of the GDPR.

You can withdraw consent and object to marketing communications at any time by using the unsubscribe link in the emails or writing to info@borrominifirenze.it. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal and does not stop necessary communications about orders already placed or account management.

You can also object to functional reminders by using the unsubscribe link, replying “Stop reminders” or writing to info@borrominifirenze.it. We respect recorded unsubscribes and other objections.

This service uses Shopify. Data retention follows the criteria described in the section on security and retention of information, according to the purposes for which the data is processed. The other rights and contact details in this policy continue to apply.

AI-assisted chat

We use Shopify to power AI-assisted chat on our online store. When you use the chat, Shopify processes personal data, including the content of chat communications, in real time to generate responses and improve the quality of the assistant over time. Conversation history is accessible to R.V.M. S.r.l. through Shopify Inbox. Please do not share information that is unnecessary for your request. For more information about Shopify’s processing, see the Shopify Consumer Privacy Policy: https://www.shopify.com/legal/privacy/consumers.

Cookies, Trackers and Preferences

The site uses Pandectes to manage preferences. You can reopen the panel using the “Cambia il tuo consenso” (change your consent) button and change the optional categories:

  • Strictly necessary: essential site functions, security, the cart and remembering your choices; these do not require consent.
  • Functional: additional features and personalisation.
  • Performance: measurement and non-essential statistics about site use.
  • Targeting: personalised advertising and related measurement.

Optional categories require the relevant consent. Refusing or withdrawing it does not prevent purchases; some additional features may be unavailable. This choice does not subscribe you to or unsubscribe you from the newsletter. Withdrawal applies to future uses requiring consent. You can also manage or delete cookies in your browser settings; after deletion you may need to set your preferences again.

Our store uses Pandectes to remember your preferences in a cookie configured to last 365 days. You can change your choices or delete the cookie before it expires; deleting it may prompt a new request for your preferences.

Email statistics: open tracking is disabled for emails sent through Shopify Messaging; the service continues to record link clicks to measure interactions with messages. The website’s cookie preferences apply to browsing and do not, by themselves, constitute a choice about email tracking.

How We Disclose Personal Information

Relevant data is accessible to authorised personnel and the providers involved: Shopify for the platform and Inbox; Brevo/PushOwl for managing contacts and communication preferences, integrating order and delivery data, and collecting browsing events through connected trackers, subject to consent where non-essential; Pandectes for privacy preferences; Foxkit for features and forms; and Judge.me for reviews. Google & YouTube and Facebook & Instagram connect the store to Google and Meta; non-essential measurement and advertising must respect applicable preferences.

The withdrawal form also uses Cloudflare and Google Apps Script, Sheets and email services to process requests, retain records and receipts and send confirmations. Google is also used for operational reports. Payment providers, carriers and administrative and legal professionals are involved to the extent needed for their services.

Providers processing data on our behalf act as processors; those independently determining purposes and means for specific processing also apply their own notices. Published reviews are publicly visible. We disclose data to authorities where legally required or necessary to protect a right. You can request details about recipients using our contact information.

Relationship with Shopify

Shopify hosts and operates the store platform and checkout, processing necessary data on our behalf under its Data Processing Addendum. Data is also shared with providers involved in the services used, who may be located in countries other than your own.

Shopify Network Intelligence is enabled on our store. Shopify uses data from our customers together with data from customers of other merchants to provide Enhanced Services, including analytics, personalisation and advertising features based on interactions with our store, other merchants and Shopify. This does not allow other merchants to access our customers' data. Advertising processing requiring consent remains subject to your choices, and you can withdraw that consent. For this processing Shopify acts as an independent controller and handles requests concerning the data: see its Consumer Privacy Policy and privacy portal.

Third Party Websites and Links

When following an external link or using an independent third-party service, also consult its privacy notice. Do not publish confidential information in reviews or public spaces.

Children's Data

The store is not directed at children. If you believe a child has provided unnecessary information, contact us so we can review its processing and delete it where applicable.

Security and Retention of Your Information

We use technical and organisational measures to protect information, without being able to guarantee absolute security. Do not send sensitive information or credentials unnecessary for your request.

Retention depends on the purpose:

  • Orders and administrative records: to fulfil purchases and handle returns, warranties and related obligations. Records subject to Article 2220 of the Italian Civil Code are retained for ten years from the last entry; this period does not apply indiscriminately to every customer record.
  • Accounts, support and withdrawal: to manage the account or request and document statements and receipts; subsequently, only what is needed for legal obligations or specific disputes within applicable periods.
  • Newsletter: while consent remains in place and data remains relevant. Withdrawal or objection stops mailings; we retain the minimum information necessary to prevent further unwanted contact.
  • Reviews and reports: while relevant to publication or operational analysis, limiting identifying information; further retention requires a specific need.
  • Privacy preference records: Pandectes retains pseudonymous choice records on its servers for six years, regardless of the subscription plan, according to its privacy policy. Records include the consent identifier, date and time, choice, partially masked IP address, country/region and device type, to document the preferences expressed. This retention is separate from the 365-day cookie that remembers the choice in your browser.
  • Shopify email events: Shopify documents the availability of email events from the last 26 months in customer segmentation. This period concerns those events and does not set a general expiry for all reports, backups or the customer profile.
  • Google Analytics 4: event-level and user-level data retention is set to 14 months. For user-level data only, each new activity restarts the period, so associated data may be retained beyond 14 months from the first visit. Google deletes expired data on a monthly cycle. Standard aggregated reports are not subject to this setting and may remain available for longer.
  • Brevo transactional email logs: retention is set to one month for all senders; previews of new transactional emails are not stored. These settings apply to logs and previews and do not determine how long contact profiles or preferences are retained.
  • Cookies: session cookies operate during the session; persistent cookies remain on the device until their technical expiry or deletion. Duration and management depend on the tool and browser; also consult the relevant providers' privacy notices.
  • Security and disputes: to examine the event and protect rights within applicable periods.

The dedicated checkout reminder section also applies to that activity. Keeping records for legal obligations does not authorise their use for marketing.

Your Rights and Choices

Subject to the GDPR's conditions, you can request access, rectification, erasure, restriction and portability and object to processing based on legitimate interests. You can object to direct marketing, including related profiling, at any time. You can withdraw consent without affecting the lawfulness of earlier processing.

Write to info@borrominifirenze.it. For the newsletter, you can use the unsubscribe link in emails; for trackers, use the preferences panel. Unsubscribing from marketing does not stop necessary order or account communications. We may request proportionate information to verify identity; you can also act through an authorised representative. We respond without undue delay, normally within one month; any GDPR-permitted extension is communicated within the first month with the reasons.

Choices Under US Privacy Laws

Where US laws apply, you can request an opt-out from sale or sharing for targeted advertising through the data-sharing choices page. Within its applicable territorial scope, the Global Privacy Control signal is treated as a request for the browser and device used and, if they can be associated, the Shopify account. These choices do not replace consent required in the European Economic Area. Exercising rights does not result in discrimination; you can also contact us to appeal the outcome of a request.

Complaints

You can contact us and complain to the Italian Data Protection Authority or the competent supervisory authority, without first having to obtain a response from us.

International Transfers

Shopify's primary hosting is configured in the European Union; this does not exclude access or processing outside the EEA by providers and subprocessors. Transfers follow Chapter V GDPR, using adequacy decisions or appropriate safeguards. For Shopify, consult its DPA and subprocessor list and locations: depending on the transfer, these provide for binding corporate rules, standard contractual clauses or adequacy. Other providers have separate arrangements. You can request information and a copy of applicable safeguards from us.

Changes to This Privacy Policy

We will publish updates on this page, revise the date and provide any further notices required by law.

Contact

R.V.M. S.r.l. — Via Mottola km 2.2, 74015 Martina Franca (TA), Italy. Italian tax/VAT number 02759200732. Email: info@borrominifirenze.it. Telephone: +39 388 328 8660.