Privacy policy

Privacy notice on the processing of personal data pursuant to Regulation (EU) 2016/679 (GDPR)

Last updated: 31 August 2026

DATA CONTROLLER

ZERO GRAIN
Contact: info@zerograin.shop

PERSONAL DATA WE COLLECT

We collect the following data when you use zerograin.shop:

  • Identity and contact data: first name, last name, email address
  • Shipping data: order delivery address
  • Payment data: processed by Shopify Payments; we do not store card details
  • Browsing data: IP address, browser type, pages visited, access time
  • Data provided voluntarily: messages sent by email

PURPOSES AND LEGAL BASIS

Your data is processed for the following purposes:

  • Order fulfilment and payment management. Legal basis: performance of a contract (Art. 6(1)(b) GDPR)
  • Order-related communications (confirmations, tracking, returns). Legal basis: performance of a contract (Art. 6(1)(b) GDPR)
  • Newsletter and marketing communications, only with your explicit consent. Legal basis: consent (Art. 6(1)(a) GDPR), which you may withdraw at any time
  • Tax, accounting and other legal obligations. Legal basis: legal obligation (Art. 6(1)(c) GDPR)
  • Service improvement and aggregate analytics. Legal basis: legitimate interest (Art. 6(1)(f) GDPR)

COOKIES

The site uses technical cookies necessary for the platform to function. We do not use advertising profiling cookies without consent.

THIRD PARTIES

Your data may be shared with:

  • Shopify Inc. (USA), e-commerce platform and payment processor. Privacy policy available at shopify.com/legal/privacy
  • Couriers and shipping providers, solely for order delivery
  • Competent authorities, where required by Italian or EU law

INTERNATIONAL TRANSFERS

Shopify is based in the United States. Data transfers take place in accordance with the safeguards provided for by Articles 45-46 GDPR (Standard Contractual Clauses adopted by Shopify).

DATA RETENTION

  • Order data: kept for 10 years to comply with tax obligations (Italian Presidential Decree 633/1972)
  • Marketing data: kept until consent is withdrawn
  • Browsing data: kept in aggregate form for up to 12 months

YOUR RIGHTS (Articles 15-22 GDPR)

You have the right to:

  • Access your personal data
  • Rectify inaccurate or incomplete data
  • Request erasure (right to be forgotten), subject to legal obligations
  • Restrict or object to processing
  • Request data portability in a machine-readable format
  • Withdraw marketing consent at any time
  • Lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it)

CONTACT

To exercise your rights or for any question about the processing of your personal data:

info@zerograin.shop