Privacy policy

Data controller

This policy describes how Della Rovere S.r.l., owner of the Cains Moore brand, collects and processes the personal data of users of www.cainsmoore.it, in accordance with Regulation (EU) 2016/679 (GDPR) and applicable Italian law.

Data controller: Della Rovere S.r.l.
Registered office: Via Molinetto 40/A, 44011 Longastrino (FE), Italy
VAT and tax code: 01528630385
Privacy contact: info@cainsmoore.it

What data we collect

Browsing data

In the course of normal operation, the website's IT systems and software procedures acquire certain data whose transmission is inherent in the use of internet communication protocols: IP address, browser and device type, operating system, pages visited, date and time of access and other technical parameters.

Data you provide to us

Orders and purchases: first and last name, shipping and billing address, email, telephone number, order details.
Customer account: login credentials, order history, saved addresses.
Newsletter: email address and, if you provide it, your name.
Contact and support requests: the data contained in the messages you send us by email, contact form, telephone or WhatsApp.

Payment data

Payments are handled by specialised providers such as Shopify Payments, PayPal and Klarna. Your card details (number, expiry date, security code) are transmitted directly to these providers and processed by them as independent controllers under their own privacy policies: the controller has no access to card numbers and does not store them. We receive only the outcome of the transaction and the data required to manage the order.

Purposes and legal bases of processing

Order management (purchase, shipping, returns, refunds, customer service) and management of your customer account — legal basis: performance of the contract to which you are party, or of pre-contractual measures taken at your request (Art. 6.1.b GDPR).
Tax, accounting and legal obligations, including the retention of sales documents — legal basis: legal obligation (Art. 6.1.c GDPR).
Newsletter and marketing communications, sending news, initiatives and offers — legal basis: your consent (Art. 6.1.a GDPR), which may be freely withdrawn at any time.
Website security, fraud prevention, aggregate statistics and service improvement — legal basis: the controller's legitimate interest (Art. 6.1.f GDPR) in providing a secure and efficient service.
Legal defence, to establish, exercise or defend legal claims — legal basis: the controller's legitimate interest.

Providing the data required to fulfil an order is essential: without it we cannot enter into or perform the contract. Providing data for marketing purposes is optional.

Store platform and data recipients

Our online store is built on the Shopify platform: Shopify International Ltd hosts the website's data and processes it as a data processor on our behalf, under an agreement compliant with Art. 28 GDPR.

Data may also be disclosed, to the extent necessary for the purposes set out above, to:

couriers and logistics operators (BRT, GLS, DHL, FedEx) for the delivery of orders and the handling of returns;
payment providers (Shopify Payments, PayPal, Klarna) for the execution and security of transactions;
IT, email marketing and support service providers, appointed as data processors;
tax, accounting and legal advisers and the competent authorities, where required by law.

Data is neither disseminated nor sold to third parties.

Transfers of data outside the European Union

Some providers, including the Shopify platform, may also process data outside the European Economic Area. In such cases the transfer takes place only where adequate safeguards under Chapter V of the GDPR are in place: an adequacy decision of the European Commission or standard contractual clauses, accompanied, where necessary, by supplementary security measures.

You may request a copy of the safeguards adopted by writing to info@cainsmoore.it.

Cookies and similar technologies

The website uses technical cookies, which are necessary for the operation of the store and the shopping cart, and — subject to your consent — analytics and marketing cookies.

You may give, change or withdraw your preferences at any time through the consent banner on the website and from the Your privacy choices page, where you can also object to the sharing of your data for advertising purposes.

How long we keep your data

Order data, invoices and accounting documents: 10 years from recording, for tax and civil law obligations.
Customer account data: until you request deletion of the account.
Newsletter subscription: until consent is withdrawn or you unsubscribe from the list.
Support requests: for as long as necessary to handle them and for the subsequent period useful for the defence of a legal claim.
Browsing data and cookies: for the periods indicated in the consent banner.

At the end of the periods indicated, data is deleted or irreversibly anonymised.

Your rights

As a data subject you may exercise at any time the rights set out in Articles 15-22 of the GDPR:

access to your personal data and obtaining a copy of it;
rectification of inaccurate data and completion of incomplete data;
erasure of data (the "right to be forgotten"), in the cases provided for;
restriction of processing;
data portability in a structured, machine-readable format;
objection to processing based on legitimate interest and, in any event, to direct marketing;
the right not to be subject to solely automated decisions producing significant legal effects.

You may also withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal: for the newsletter it is enough to use the unsubscribe link included in every message.

To exercise your rights, write to info@cainsmoore.it. We will reply within the time limits set by law.

Complaint to the supervisory authority

If you believe that the processing of your data infringes the GDPR, you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome) or with the supervisory authority of the Member State in which you reside, or to bring proceedings before the courts.

Minors

Our services are not intended for children under the age of 16: we do not knowingly collect data relating to children of that age without the consent of the holder of parental responsibility. If we become aware of processing carried out without such consent, we delete the data.

Data security

We adopt appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or disclosure, including the encryption of communications via the HTTPS protocol and selective access to data by authorised staff only.