This page describes the cookies and other tracking tools used by the online store available at boutique.ilsanpietro.it, the purposes for which they are used and how users can give, refuse or withdraw their consent. It supplements the privacy policy of the online store, to which reference is made for anything not expressly set out below.
Latest update: September 24, 2026
Data controller
San Pietro S.p.A., trading as Il San Pietro di Positano, VAT no. 02394820654, via Laurito 2, 84017 Positano (SA), Italy. Any request concerning the processing of personal data may be sent to assistant@ilsanpietro.it.
The controller has appointed a Data Protection Officer (DPO), who can be contacted at dpo.ilsanpietro@figurati.it.
What cookies are and how they are classified
Cookies are small text strings that the website visited stores in the user's browser and that are sent back to the same website on subsequent visits. Similar technologies, such as pixels, identifiers and scripts, are treated on this page in the same way and are referred to together with cookies as "tracking tools".
The controller classifies tracking tools according to the purpose for which they are used, on the basis of the following criteria:
-
technical, where they are strictly necessary for the operation of the store or for the provision of a service explicitly requested by the user, such as managing the basket, the checkout and the storage of cookie choices. Their use does not require the user's consent, pursuant to Section 122(1) of the Italian Personal Data Protection Code (Legislative Decree no. 196/2003);
-
statistics and analytics, where they are used to measure traffic and to understand how users interact with the store;
-
marketing, where they are used to collect information for promotional purposes;
-
preferences, where they store settings chosen by the user beyond what is strictly necessary for the operation of the store.
Tools in the last three categories are used only with the user's prior consent, pursuant to Section 122(1) of Legislative Decree no. 196/2003 and Article 6(1)(a) of Regulation (EU) 2016/679 (the "GDPR"). In the absence of consent, only technical tools are placed on the first visit.
Tracking tools used by the store
The store is built on the Shopify platform, provided by Shopify International Limited, Dublin, Ireland, acting as data processor on behalf of the controller. The tools listed below are those that Shopify declares it places, through its platform, on the online stores operating on it. They are set on the store's domain and processed by Shopify on behalf of the controller. The durations shown are those declared by the supplier; "session" means that the tool is deleted when the browser is closed.
Technical Cookies
This Application uses so-called “technical” Cookies and other similar Trackers to carry out activities that are strictly necessary for the operation or delivery of the Service.
Trackers managed by third parties
Shopify
Company: Shopify Inc.
Place of processing: Canada
Personal Data processed: device information +2
Shopify is a platform provided by Shopify Inc. that allows the Owner to build, run and host an e-commerce website. This service may place Trackers on the User’s device. For the most up-to-date and comprehensive information, refer to the service’s official documentation.
Personal Data processed: device information, trackers, usage data
| Name | Purpose | Duration |
|---|---|---|
| _ab | Used in connection with access to the store admin | 3 years |
| _customer_account_shop_sessions | Tracks user sessions for customer accounts | 1 month |
| _identity_session | Stores the user's identity session identifier | 3 years |
| _master_udr | Persistent device identifier used for security and login | Duration of the session |
| _merchant_essential | Stores information essential to merchant-facing features such as the admin | 2 years |
| _orig_referrer | Tracks landing pages and referral source | 14 days |
| _pay_session | Supports the Shop Pay / payment session | Duration of the session |
| _s | Shopify analytics (session tracking) | 30 minutes |
| _secure_admin_session_id | Maintains the store admin session | 4 months |
| _secure_admin_session_id_csrf | Protects the admin session against cross-site request forgery | 4 months |
| _shopify_country | Sets the country and currency based on the visitor's location | Duration of the session |
| _shopify_d | Shopify analytics | Duration of the session |
| _shopify_essential | Stores information essential to storefront functions such as cart, checkout and login | 2 years |
| shopify_essential | Stores information essential to storefront functions | 2 years |
| _shopify_evids | Shopify analytics | Duration of the session |
| _shopify_fs | Shopify analytics | 1 year |
| _shopify_m | Manages customer privacy settings | Duration of the session |
| _shopify_s | Shopify analytics (session tracking) | 30 minutes |
| _shopify_test | Checks whether the browser accepts cookies | 1 minute |
| _shopify_tm | Manages customer privacy settings | Duration of the session |
| _shopify_tw | Manages customer privacy settings | Duration of the session |
| _storefront_u | Helps with updating customer account information | 1 minute |
| _tracking_consent | Stores the visitor's tracking and consent preferences | Duration of the session |
| _y | Shopify analytics (identifies returning visitors) | 1 year |
| auth_state_* | Supports customer account authentication | 25 minutes |
| c | Used in connection with the cart and checkout | 2 years |
| cart | Stores the contents of the shopping cart | 14 days |
| cart_currency | Keeps new carts in the same currency as the last checkout | 14 days |
| cart_ver | Used in connection with the shopping cart | 14 days |
| checkout_queue_checkout_token | Manages the checkout queue during high traffic | 2 years |
| checkout_queue_token | Manages the checkout queue during high traffic | 2 years |
| checkout_session_token | Maintains the checkout session | 21 days |
| checkout_worker_session | Used in connection with checkout | 3 days |
| customer_account_new_login | Supports customer login | 20 minutes |
| customer_account_preview | Lets merchants preview customer accounts | 7 days |
| customer_auth_provider | Records the authentication provider used to log in | Indefinite |
| customer_auth_session_created_at | Records when the customer login session was created | Indefinite |
| discount_code | Stores a discount code applied to the cart | Duration of the session |
| keep_alive | Keeps the session active, including localization settings | Duration of the session |
| localization | Stores the store's language and country settings | 14 days |
| login_with_shop_finalize | Supports customer login through Shop | 5 minutes |
| master_device_id | Used in connection with merchant login | 2 years |
| shopifyChatData | Stores data for the Shopify chat feature | Duration of the session |
| shopify_pay | Supports login and payment with Shop Pay | 2 years |
| source_name | Records the source of an order or visit | Indefinite |
| storefront_digest | Grants access to password-protected storefronts | 2 years |
Cloudflare
Company: Cloudflare, Inc.
Place of processing: United States
Personal Data processed: trackers; various types of data as specified in the privacy policy of the service
Service provided by: Cloudflare, Inc. (United States) – Privacy Policy
| Name | Purpose | Duration |
|---|---|---|
| _cfuvid | Used by Cloudflare's rate limiting to tell apart different visitors who share the same IP address | Indefinite |
| cf_clearance | Records that the visitor passed a Cloudflare security or bot challenge, so they aren't challenged again | 30 minutes |
Statistics and analytics
This Application uses Trackers to measure traffic and analyze User behavior to improve the Service.
Trackers managed by third parties:
Service: Shopify Analytics, an analytics service provided by Shopify Inc.
Personal Data processed: browsing history, clicks, country, device information, product interaction, purchase history, referral URL, session statistics, trackers, usage data
Service provided by: Shopify Inc. (Canada) – Privacy Policy
Place of processing: Canada
| Name | Purpose | Duration |
|---|---|---|
| _landing_page | Tracks the page the visitor first landed on | 3 hours |
| _merchant_analytics | Stores analytics data for merchant-facing areas such as the store admin | 2 years |
| _orig_referrer | Tracks the referral source and landing pages | 14 days |
| _shopify_analytics | Stores analytics data for the storefront and checkout | 2 years |
| _shopify_s | Shopify analytics (session tracking) | 30 minutes |
| _shopify_y | Shopify analytics (identifies returning visitors) | 2 years |
| shop_analytics | Stores analytics data for the Shop app and related services | 2 years |
Marketing tools — only with prior consent
|
Name |
Purpose |
Duration |
|---|---|---|
|
_shopify_marketing |
Contains marketing data relating to browsing in the store and at checkout |
1 year |
Preference tools — only with prior consent
|
Name |
Purpose |
Duration |
|---|---|---|
|
shopify_override_user_locale |
Stores the user's language setting |
1 year |
For traffic routing and network protection, Shopify in turn relies on Cloudflare, Inc., based in the United States of America, as its own sub-processor. Any tools used for this purpose fall within the technical category and are not used for analytics or marketing purposes.
Further information on the platform's tools is available in Shopify's cookie policy and Shopify's privacy policy.
Recipients and transfers
The information collected through tracking tools is processed by Shopify International Limited, as data processor, and by its sub-processors. As set out in the privacy policy, the supplier may transfer the data to other companies within its group and to its own suppliers located in Canada, which the European Commission has recognised as ensuring an adequate level of protection of personal data, and in the United States of America, where the transfer is covered by Standard Contractual Clauses pursuant to Article 46 GDPR.
The information collected is not disclosed to third parties for their own purposes. Statistical information is retained in accordance with the terms of the Shopify platform, as set out in the privacy policy.
How to give, refuse or withdraw consent
On the first visit to the store, a banner is displayed allowing the user to accept all tracking tools, to refuse those other than technical ones, or to make separate choices by category. Refusing is as immediate as accepting. Without an express choice to accept, no tool other than technical ones is placed.
The user's choice is stored by means of the technical cookie _tracking_consent. The user may change it at any time, giving consent previously refused or withdrawing consent previously given, through the Cookie preferences link in the footer of every page of the store. Withdrawal does not affect the lawfulness of processing carried out before it.
How to control or delete Cookies and similar technologies via your device settings
Users may use their own browser settings to:
- See what Cookies or other similar technologies have been set on the device;
- Block Cookies or similar technologies;
- Clear Cookies or similar technologies from the browser.
The browser settings, however, do not allow granular control of consent by category.
Users can, for example, find information about how to manage Cookies in the most commonly used browsers at the following addresses:
Users may also manage certain categories of Trackers used on mobile apps by opting out through relevant device settings such as the device advertising settings for mobile devices, or tracking settings in general (Users may open the device settings and look for the relevant setting).
Consequences of denying the use of Trackers
Users are free to decide whether or not to allow the use of Trackers. However, please note that Trackers help this Application to provide a better experience and advanced functionalities to Users (in line with the purposes outlined in this document). Therefore, if the User chooses to block the use of Trackers, the Owner may be unable to provide related features.
User rights
With regard to the personal data collected through tracking tools, users may exercise the rights set out in Articles 15 to 22 GDPR, and in particular:
-
withdraw their consent at any time;
-
access their data and obtain a copy of it;
-
obtain its rectification or erasure;
-
obtain the restriction of processing;
-
receive their data in a structured format and transmit it to another controller, where applicable;
-
lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of the Member State of their habitual residence, place of work or place of the alleged infringement.
Requests may be sent to assistant@ilsanpietro.it or to the DPO at dpo.ilsanpietro@figurati.it.
Changes
The controller updates this page whenever the tools used change. In the event of significant changes, and in particular where new third parties are added, the request for consent is presented again.
Last updated: 28 september 2026 — revision 1.0