This policy explains how PACO S.R.L., as data controller, processes the personal data of users who visit and use the Vybes.it e-commerce website, create an account, place orders, request support or use the features available on the website.

Personal data are processed in accordance with Regulation (EU) 2016/679 (GDPR), Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018, and the applicable data protection legislation.

1. Data Controller

The data controller is:

PACO S.R.L.
Tax code and Companies Register number: 04018870545
VAT No.: 04018870545
REA: PG-373544
Certified email (PEC): pacosrlcert@pec.it
Email: info@vybes.it
Tel: +39 3899917988

View registered office and full company details

2. Categories of personal data processed

Depending on how the website and its services are used, the following categories of personal data may be processed:

• identification and contact data, such as name, surname, address, email address and telephone number;
• account data, such as credentials, technical identifiers and information required to manage the reserved area;
• order data, such as products purchased, amounts, order status, delivery address, returns, refunds and communications relating to the purchase;
• payment data, limited to the information necessary to manage the transaction; the Seller does not acquire or store full payment card details where those details are processed directly by the payment service provider;
• customer support data, including the content of requests sent by email, certified email (PEC) or other channels made available by the website;
• technical and security data, such as IP address, access logs, device and browser information, and data needed to prevent abuse, fraud or unauthorised access;
• data collected through cookies or similar technologies, within the limits described in the Cookie Policy and according to the user's preferences.

3. Purposes and legal bases of processing

Personal data may be processed for the following purposes:

• account management and pre-contractual requests: to allow registration, access to the reserved area and management of requests made before a purchase. The legal basis is taking steps at the data subject's request prior to entering into a contract and, where applicable, performance of the contract;
• order management and performance of the sales contract: to process orders, receive payments, arrange shipping, manage cancellations, withdrawals, returns, refunds, warranty claims and after-sales support. The legal basis is performance of the contract;
• compliance with legal obligations: for tax, accounting, administrative and consumer protection obligations and to respond to lawful requests from authorities. The legal basis is compliance with a legal obligation;
• security and fraud prevention: to protect the website, accounts, payment systems and transactions from abusive or fraudulent use. Processing may be based on performance of the contract, legal obligations or the Controller's legitimate interest in securing its services, subject to the rights and freedoms of data subjects;
• handling disputes and protecting legal rights: to establish, exercise or defend legal claims in or out of court. The legal basis is the Controller's legitimate interest in protecting its rights;
• cookies, analytics and marketing through tracking technologies: non-essential cookies and tools are used only where permitted by applicable law and, where required, on the basis of the user's consent expressed through the preference management system.

4. Confidentiality of purchases

Given the nature of the products available on Vybes.it, order details may concern particularly private aspects of a user's personal sphere. Such information is therefore processed in accordance with the principles of data minimisation, necessity and confidentiality, and access is limited to persons who genuinely need it for order management, customer support, legal obligations, security or the protection of legal rights.

Any further processing involving profiling or marketing based on detailed purchase information may be carried out only where an appropriate legal basis exists and, where required by applicable law, with the data subject's specific consent.

5. Provision of personal data

Providing the data required to create and manage an account, place an order, receive delivery, manage payment, exercise the right of withdrawal or receive support is necessary to provide the relevant service. Failure to provide essential data may make it impossible to complete the requested operation.

Providing data for non-essential purposes, including the use of non-technical cookies or tracking technologies, is optional. Refusing consent does not prevent normal browsing or purchases, except for any additional features that depend on the specific tool.

6. Processing methods and security

Personal data are processed using IT systems and, where necessary, organisational procedures appropriate to the purposes described in this policy.

The Controller adopts appropriate technical and organisational measures to reduce the risks of unauthorised access, loss, destruction, alteration or unauthorised disclosure of personal data, taking into account the nature of the data processed, the state of the art and the risks associated with processing.

7. Recipients of personal data

Personal data may be disclosed, only to the extent necessary for the purposes described above, to the following categories of recipients:

• payment service providers, including PayPal and Nexi, according to the procedures applicable to their respective services;
• carriers and logistics providers responsible for delivery or returns;
• hosting, infrastructure, maintenance, security, email and other technical service providers necessary for operation of the website;
• accounting, tax and legal advisers and other professionals where necessary;
• public authorities, courts or other entities where disclosure is required by law or requested by a competent authority.

Depending on the service and circumstances, providers may act as processors on behalf of the Controller or as independent data controllers.

8. Transfers of data outside the EEA

Some technical, payment or integrated service providers may process personal data outside the European Economic Area. Where this occurs, transfers will be carried out in accordance with Articles 44 et seq. of the GDPR, on the basis of an adequacy decision by the European Commission or other safeguards provided by applicable law, such as Standard Contractual Clauses where required.

9. Retention periods

Personal data are retained no longer than necessary for the purposes for which they were collected, taking into account legal obligations and the need to protect the rights of the Controller and data subjects.

• account data: for the duration of the account and, after closure, for any period necessary to comply with legal obligations or protect legal rights;
• order, invoicing and accounting data: for the period required by applicable tax and civil law, generally up to 10 years for accounting records;
• support, dispute, return and refund data: for the time necessary to handle the request and subsequently for the period required by applicable law or necessary to protect legal rights;
• technical and security data: for a period proportionate to security, fraud-prevention and incident-management purposes;
• data collected through cookies or similar technologies: according to the periods shown by the preference management system and the Cookie Policy.

10. Cookies and tracking technologies

The website uses necessary technical cookies and may use third-party cookies or tools for analytics, statistics or marketing subject to consent where required.

For more information about the categories of cookies used and preference management, please see the Cookie Policy.

11. Data subject rights

In the cases and within the limits provided by the GDPR, data subjects may exercise the rights set out in Articles 15-22, including the right to:

• obtain confirmation as to whether personal data are being processed and access those data;
• request rectification of inaccurate data or completion of incomplete data;
• request erasure of data where the legal requirements are met;
• request restriction of processing;
• object to processing where applicable;
• receive data in a structured, commonly used and machine-readable format and, where applicable, exercise the right to data portability;
• withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.

To exercise these rights, you may write to info@vybes.it or to the certified email address pacosrlcert@pec.it.

12. Right to lodge a complaint

Data subjects have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) pursuant to Article 77 GDPR, without prejudice to any other administrative or judicial remedy provided by law.

Information on how to lodge a complaint is available on the official website of the Italian Data Protection Authority.

13. Automated processes and anti-fraud checks

Security and anti-fraud checks may use automated tools to detect anomalies or potentially risky transactions. If a fully automated decision-making process is used that produces legal effects concerning the data subject or similarly significantly affects them, the information and safeguards required by applicable law, including Article 22 GDPR where applicable, will be provided.

14. Changes to this Privacy Policy

This Privacy Policy may be updated over time to reflect changes to services, processing activities, service providers or applicable legislation.

Any changes will be published on this page. Where necessary, additional notices will be provided to data subjects as required by law.

15. Contact details and related documents

For information about the processing of personal data or to exercise your rights, you may contact:

PACO S.R.L.
Email: info@vybes.it
Certified email (PEC): pacosrlcert@pec.it
Tel: +39 3899917988

Please also see the Cookie Policy and the website's Terms and Conditions.