Privacy Policy

Welcome to the Carlo Esposito Pelletteria website (the “Site”).
The protection of your privacy and the security of your personal data are important to us. For this reason, we collect and process personal data with care, in compliance with applicable legislation, and by adopting appropriate technical and organizational measures to protect it.

This Privacy Policy describes what personal data we may collect through the Site, for what purposes we use it, on what legal bases, with whom we may share it, and what rights you can exercise.

1. General information

Who is the Data Controller?
Enjoy Italia s.r.l., with registered office at Via Melito, 9 - 83029 Solofra (AV), VAT No. 02846010649 and REA: AV - 187311, hereinafter “Carlo Esposito Pelletteria”, is the Data Controller for the processing of personal data collected through the Site pursuant to Regulation (EU) 2016/679 (“GDPR”).

For any information regarding the processing of personal data or to exercise your rights, you can contact us:

Subject of the communication: “Privacy”.

Who is the Data Processor?
The Data Processor, who can be contacted to exercise rights pursuant to Art. 12 of GDPR 2016/679 and/or for any clarifications regarding personal data protection, can be reached by sending an e-mail to: info@carloespositoofficial.it

2. What personal data do we collect?

Through the Site, we may collect and process the following categories of personal data:

  • Data required for purchase: first and last name, e-mail address, telephone number, shipping address, billing address, tax code, and any other data necessary for order management.
  • Payment-related data: information regarding the selected payment method. Full payment card details are processed, where applicable, directly by the relevant payment service providers and are not normally stored in the Controller's systems.
  • Account registration data: first and last name, e-mail address, password, and information necessary for managing the Personal Area.
  • Data provided for customer support: information voluntarily communicated via e-mail, telephone, WhatsApp, or other contact channels, including requests regarding products, colors, availability, orders, returns, and repairs.
  • Data for newsletter subscription: e-mail address and, if requested and provided, additional information necessary for managing communication preferences.
  • Data for commercial communications: e-mail address and/or telephone number, processed for sending promotional communications exclusively in the cases and according to the procedures permitted by applicable law.
  • Data relating to returns, refunds, and after-sales support: information necessary for managing requests for returns, refunds, warranty, repairs, or support.
  • Browsing data: IP addresses, device information, browser, operating system, pages visited, access times, technical logs, and other data collected automatically during browsing.
  • Data voluntarily provided by the user: any information entered in forms on the Site, in reviews, or in communications sent to the Controller.
  • Third-party data provided by the user: if the user indicates a recipient other than themselves, for example for a gift shipment, they must ensure they have provided the privacy information to the data subject and are authorized to communicate their data.

The Site is not intended for minors under 18 years of age. We therefore invite underage users not to provide personal data through the Site.

3. For what purposes do we use personal data?

Collected personal data may be processed for the following purposes:

  • Order management: receiving and managing purchases, checking product availability, processing payments, preparing and shipping orders.
  • Administrative and tax compliance: issuing tax documents, managing accounting, and complying with legal obligations.
  • Service communications: sending order confirmations, shipping updates, communications regarding returns, refunds, warranty, support, and other information necessary for the proper management of the contractual relationship.
  • Payment management: processing transactions through payment service providers selected by the user, including, where available, PayPal, Scalapay, card payments, bank transfer, and cash on delivery.
  • Personal account management: creation and administration of the Personal Area, order viewing, and management of user addresses and preferences.
  • Customer service: responding to requests sent via e-mail, telephone, WhatsApp, or other support channels.
  • Management of returns, refunds, warranties, and repairs: processing data required to handle post-purchase requests.
  • Newsletter delivery: sending informative and commercial communications regarding products, news, and initiatives of Carlo Esposito Pelletteria, subject to consent where required.
  • Commercial communications to existing customers: sending, within the limits allowed by art. 130, paragraph 4 of Legislative Decree 196/2003, communications regarding products or services similar to those already purchased, unless objected to by the data subject.
  • Analysis and improvement of the Site: statistical analysis, verifying proper platform operation, improving services, and optimizing browsing experience.
  • Fraud and abuse prevention: security checks, preventing fraudulent transactions, improper use of the Site, and illegal activities.
  • Establishment and defense of rights: managing disputes, exercising and defending rights in judicial or extrajudicial settings.

4. Cookies and other tracking tools

The Site uses technical cookies and tracking tools and, subject to consent when required, analytical, functional, or marketing tools.

Technical cookies are necessary for the proper functioning of the Site and the provision of services requested by the user, such as shopping cart management, purchase processing, authentication, and saving preferences.

Any analytical or profiling cookies are used exclusively in compliance with the choices expressed by the user through the consent management system on the Site.

For detailed information on the cookies used, their purposes, and how to change your preferences, please consult our Cookie Policy.

Cookie preferences can be modified at any time through the dedicated management tool available on the Site.

5. Newsletter and commercial communications

If the user chooses to subscribe to the newsletter, their e-mail address will be used to send communications regarding products, news, promotions, and initiatives of Carlo Esposito Pelletteria, based on consent provided where necessary.

The user may withdraw their consent at any time by using the unsubscribe link located at the bottom of each communication or by contacting the Controller at the details provided in this notice.

Following a purchase, the Controller may also send commercial communications regarding products or services similar to those purchased, pursuant to art. 130, paragraph 4 of Legislative Decree 196/2003, unless objected to by the data subject.

6. Legal basis for processing

The processing of personal data is based on the following legal conditions:

  • Performance of a contract – Art. 6, para. 1, point (b) GDPR: management of orders, payments, shipping, returns, refunds, support, and account management.
  • Compliance with a legal obligation – Art. 6, para. 1, point (c) GDPR: tax, accounting, administrative, and regulatory obligations.
  • Legitimate interest of the Controller – Art. 6, para. 1, point (f) GDPR: Site security, fraud prevention, protection of rights, technical and organizational management, and sending commercial communications regarding similar products or services within legal limits.
  • Consent of the data subject – Art. 6, para. 1, point (a) GDPR: newsletter subscription, marketing activities, non-technical cookies, and other processing requiring specific consent.

Providing data marked as required is essential for entering into and executing the purchase contract. Failure to provide such data may prevent order processing or service delivery.

7. Processing methods and security

Personal data is processed using electronic and, where necessary, paper-based tools, in accordance with principles of fairness, lawfulness, transparency, data minimization, and confidentiality.

The Controller adopts appropriate technical and organizational measures to prevent loss, unlawful or improper use, and unauthorized access, taking into account the nature of the data processed, risks, and current technological standards.

8. Who can process your data?

Personal data may be processed by:

  • authorized personnel of Carlo Esposito Pelletteria, duly instructed;
  • technology and hosting service providers;
  • e-commerce management service providers;
  • banking institutions and payment service providers;
  • couriers and logistics operators responsible for delivery;
  • accounting, tax, legal, and professional consultants;
  • customer support and communication service providers;
  • providers of newsletter and transactional communication services;
  • public entities, authorities, and law enforcement agencies, when required by law.

External entities processing personal data on behalf of the Controller are, where necessary, appointed as Data Processors pursuant to Art. 28 GDPR. Other entities may operate as independent data controllers according to their respective privacy notices.

9. Data transfers outside the European Economic Area

Personal data is processed, as far as possible, within the European Economic Area.

Should certain service providers involve transferring data to countries outside the European Economic Area, the transfer will take place in compliance with GDPR provisions and on the basis of an adequacy decision or other appropriate safeguards, such as Standard Contractual Clauses adopted by the European Commission, where applicable.

10. Data retention period

Personal data is retained for no longer than necessary to achieve the purposes for which it was collected, in compliance with legal obligations.

  • Order-related data: for the period necessary to manage the contractual relationship and subsequently for the timeframe required by civil, tax, and accounting obligations.
  • Tax and accounting data: for the period required by applicable law, generally 10 years, unless further retention is necessary.
  • Account data: until account deletion, subject to the need to retain certain information for legal compliance or defense of rights.
  • Newsletter and marketing data: until consent is withdrawn or an objection is submitted, unless further retention is permitted by law.
  • Support-related data: for the time necessary to handle the request and subsequently for the period required to defend the Controller's rights.
  • Returns, warranty, and repair data: for the time required to manage the request and comply with any legal obligations.
  • Browsing data and cookies: according to the timeframes indicated in the Cookie Policy and details provided by third-party providers.

At the end of retention periods, data will be deleted, anonymized, or rendered unidentifiable, unless further retention is required to fulfill legal obligations or to establish, exercise, or defend a legal claim.

11. Your rights

As a data subject, you can exercise at any time, in cases provided by law, the rights granted under Articles 15–22 of the GDPR, including:

  • obtaining confirmation as to whether or not personal data concerning you is being processed;
  • obtaining access to personal data and information regarding its processing;
  • requesting the rectification of inaccurate data or completion of incomplete data;
  • requesting the erasure of data, in cases provided by law;
  • requesting the restriction of processing;
  • objecting to processing, particularly for direct marketing purposes;
  • requesting data portability, where applicable;
  • withdrawing previously given consent, without affecting the lawfulness of processing based on consent before its withdrawal;
  • not being subject to a decision based solely on automated processing, in cases provided under Art. 22 GDPR.

To exercise your rights, you can send a request to:

info@carloespositoofficial.it
Subject: “Exercise of privacy rights”.

The Controller will respond to the request within the timeframes established by law. It may be necessary to verify the identity of the requester to protect the security of personal data.

12. Complaints to the supervisory authority

If you believe that the processing of your personal data violates applicable legislation, you have the right to lodge a complaint with the competent supervisory authority, in particular the Garante per la Protezione dei Dati Personali (Italian Data Protection Authority).

For more information, please visit the official website: www.garanteprivacy.it.

13. Links to third-party sites and services

The Site may contain links to websites, platforms, or services managed by third parties. The Controller is not responsible for how these parties process personal data.

We invite you to consult their respective privacy policies before providing personal data or using their services.

14. Changes to this Privacy Policy

The Controller reserves the right to amend or update this Privacy Policy at any time, including as a result of regulatory, technical, or organizational changes.

Changes will be published on this page, indicating the date of the update. We invite you to check this section periodically for any updates.

15. Regulatory references

The processing of personal data is carried out in compliance with Regulation (EU) 2016/679 (“GDPR”), Legislative Decree 196/2003 as amended by Legislative Decree 101/2018, as well as applicable provisions, rulings, and guidelines issued by the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali).

Last updated: 24/09/2026

Back to top