Privacy notice

1. Data controller

   The data controller is Luna Bags, with its operating office at Via A. Righi, 63/65, 50019 Osmannoro (FI), Italy. For any questions or requests concerning the processing of personal data, please write to xuqiumei7@gmail.com.

2. Personal data processed

   Depending on the context, we process identification and contact data (first name, last name, email address, phone number), business details (company name, VAT/tax number, registered and shipping addresses), login credentials for the reserved area, order history and related correspondence. We do not collect card details or online payment data, as this website does not offer direct electronic payments.

3. Purposes and legal bases

   (a) Registration and management of your customer account: taking steps prior to entering into a contract and performance of the contract (Art. 6(1)(b) GDPR).
   (b) Order processing, delivery, after-sales support and invoicing: performance of the contract and legal obligations (Art. 6(1)(b)–(c)).
   (c) Operational communications about orders, product availability and service changes: legitimate interest in ensuring proper management of the business relationship (Art. 6(1)(f)).
   (d) Direct marketing by email, where applicable: based on your explicit consent (Art. 6(1)(a)).
   (e) Protection of the controller’s rights, prevention of abuse and website security: legitimate interest (Art. 6(1)(f)).

4. Provision of data

   Providing the data required to manage orders, shipping and invoicing is mandatory; without this information we cannot supply the requested services. Providing data for marketing and promotional communications is optional and refusal to give consent does not affect the use of the online shop.

5. Recipients and service providers

   Data may be processed by duly authorised staff and by service providers supplying hosting, IT maintenance, email delivery, CRM tools, logistics and couriers, and accounting or legal consultancy. Where applicable, these parties act as data processors pursuant to Art. 28 GDPR. Data are not disclosed to the general public.

6. Transfers outside the EU

   Where some service providers are located or store data outside the EU/EEA, any transfer will take place in compliance with Chapter V of the GDPR, for example on the basis of adequacy decisions or Standard Contractual Clauses. You can request up-to-date information on such transfers by writing to xuqiumei7@gmail.com.

7. Data retention

   Account and order data are stored for the duration of the contractual relationship and thereafter for the period required by civil, tax and accounting regulations (usually up to 10 years). Data processed for marketing purposes are retained until consent is withdrawn or erasure is requested. Technical security logs are kept for limited periods, proportionate to the purposes of protecting the website.

8. Data subject rights

   You may exercise at any time the rights set out in Articles 15–22 GDPR: access, rectification, erasure, restriction of processing, data portability, objection to processing, as well as withdrawal of consent without affecting the lawfulness of processing based on consent before its withdrawal. Requests can be sent to xuqiumei7@gmail.com. You also have the right to lodge a complaint with the competent supervisory authority (in Italy, the Italian Data Protection Authority – Garante).

9. Security

   We implement appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, disclosure or alteration, in line with the state of the art and with the risks associated with the processing.

10. Updates

    This privacy notice may be updated over time, for example in case of regulatory changes or changes to the services offered. Where changes are material, you will be informed through the website or other available communication channels.