Privacy Policy

for users and visitors of the online store boutique.ilsanpietro.it

pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR)

 

This privacy policy sets out the principles governing the use, in terms of confidentiality, of the personal data provided by the users and visitors of our web services.

This page describes how the online store boutique.ilsanpietro.it handles the personal data of the users and visitors who browse it and of the customers who make purchases on it. It is the information notice required under Regulation (EU) 2016/679 (the "GDPR") and under the data protection legislation in force, and is addressed to anyone interacting electronically with the services available on this website, accessible at boutique.ilsanpietro.it.

This privacy policy applies to the online store boutique.ilsanpietro.it only and does not extend to any third-party websites reachable through the links it contains. The processing of personal data connected with bookings and stays at the Hotel is described in separate information notices.

Data controller and place of processing

The online store boutique.ilsanpietro.it is operated by:

  • San Pietro S.p.A., trading as Il San Pietro di Positano, VAT no. 02394820654, via Laurito 2, 84017 Positano (SA), Italy — Data controller for all processing activities relating to the operation of the online store, to orders and to enquiries received through this website. San Pietro S.p.A. undertakes to comply with the data protection legislation in force.

The following third-party suppliers provide technical services in connection with this website:

  • Shopify International Limited, Dublin, Ireland, provides the e-commerce platform on which the store is built and hosted, including the catalogue, basket, checkout and order management functions, acting as a data processor pursuant to Article 28 GDPR. The personal data of users located in the European Economic Area, the United Kingdom and Switzerland is processed in the first instance by the Irish company; the supplier may transfer it to other companies within its group and to its own suppliers located in Canada, which the European Commission has recognised as ensuring an adequate level of protection of personal data, and in the United States of America, where the transfer is covered by Standard Contractual Clauses pursuant to Article 46 GDPR;

  • Shopify International Limited also provides, through the Shopify Payments service, the collection and processing of payments made on the online store. In respect of customer payment data processed on behalf of the controller, the supplier acts as a data processor; in respect of the obligations arising from anti-money laundering legislation, international restrictive measures, fraud prevention and payment scheme rules, the supplier and the payment service provider it engages act as independent controllers, whose own privacy notices apply. Full payment instrument details are entered by the data subject within the supplier’s environment: the controller neither collects nor stores the full payment card number or its security code. The up-to-date list of the providers engaged by the supplier for the delivery of the service is published by the supplier itself and is available on request;

  • Digit Art Events SARL, 16 rue du Foncet, 06000 Nice, France, for the design, development and technical management of the online store, acting as a data processor.

  • Logistics operators, carriers and customs agents responsible for delivering the products purchased, to whom only the data necessary for shipment is disclosed and, for deliveries to countries outside the European Union, for customs formalities;

  • Professionals and companies assisting the Controller in accounting, tax and legal matters, within the limits of their respective services.

  • Any other external parties who may have access to the personal data held on this website will, where appropriate, be appointed as data processors by the controller. The up-to-date list of data processors may be requested from the data controller.

  • Users and visitors are asked to read this privacy policy carefully before submitting any personal information and/or completing any electronic form on this website. Browsing the website does not in itself constitute a legal basis for the processing of personal data under Article 6 GDPR. Processing activities requiring the data subject’s consent are carried out only once such consent has been obtained in the manner prescribed by the legislation in force.

Purposes and legal bases for processing

The personal data provided by users and visitors in order to make a purchase on the online store is processed in order to enter into and perform the contract of sale: order management, preparation and dispatch of the goods, service communications on the status of the order, management of payments, returns, replacements, withdrawals and refunds. The legal basis for this processing is the performance of a contract to which the data subject is party and the taking of steps at the data subject’s request prior to entering into a contract (Article 6(1)(b) GDPR). The same legal basis applies to the data of those who choose to register an account rather than to check out as a guest.

The data required for tax and accounting obligations, for electronic invoicing, for the retention of accounting records and for customs formalities in respect of shipments to third countries is processed in order to comply with a legal obligation to which the controller is subject (Article 6(1)(c) GDPR).

The data provided by users and visitors when requesting assistance and/or using the services managed through the website is used solely in order to respond to the request and/or to provide the service, and is disclosed to third parties only where strictly necessary. The legal basis is the performance of the contract where the request concerns a current order (Article 6(1)(b) GDPR) and, in all other cases, the controller’s legitimate interest in responding to those who contact it (Article 6(1)(f) GDPR).

Also processed on the basis of the controller’s legitimate interest (Article 6(1)(f) GDPR) is the data necessary to ensure the security of the online store, to prevent and detect fraud, misuse of the service and unauthorised payments, and to establish, exercise or defend legal claims. Browsing data is processed to ensure the proper functioning of the website on the same legal basis.

Processing carried out by means of cookies and similar technologies that are not necessary for the functioning of the website, including non-anonymised traffic analysis tools, is carried out solely with the data subject’s consent (Article 6(1)(a) GDPR), which may be withdrawn at any time.

As at the date of revision of this privacy policy, the online store carries out no direct marketing or personalised advertising and sends no newsletters or promotional communications.Should such activities be introduced, this privacy policy will be updated before they begin and the processing will be carried out solely on the basis of the data subject’s prior explicit consent, which may be withdrawn at any time.

Types of data processed and purposes of processing

Browsing data

The computer systems and software procedures underlying the operation of this website acquire, in the course of their normal operation, certain personal data whose transmission is inherent in the use of internet communication protocols. This information is not collected in order to be associated with identified data subjects but, by its very nature, could through processing and association with data held by third parties make it possible to identify users indirectly (IP addresses, domain names of the computers used to connect, operating system and browser, time data and so on). This data may be used solely to obtain anonymous statistical information, to check that the website is functioning properly and to ensure its security. It is retained for a limited period, it is not disseminated and it is disclosed only to the extent strictly necessary for the technical management of the service.

Data provided voluntarily by users and visitors

Where users and visitors optionally, expressly and voluntarily provide their personal data in order to make enquiries or access services, that data will be processed solely in order to deal with the enquiry or provide the service. Personal data may be disclosed to third parties only where strictly necessary in order to deal with those enquiries.

Data relating to purchase, payment and delivery

In order to complete a purchase, the following data is processed: the customer’s identification and contact details (first name and surname, email address, telephone number), the billing address and the delivery address and, at the data subject’s request, the company name, VAT number and electronic invoicing code. Data relating to the order is also processed (products purchased, quantities, amounts, currency, order date and number, any delivery instructions, correspondence relating to the order, requests for return or withdrawal).

As regards payment, the controller processes the outcome of the transaction, the amount, the payment method used, partial details of the payment instrument (last four digits of the card, scheme, expiry date) and the transaction identifier. Full payment instrument details are entered by the data subject directly within the environment of the payment service provider and are not accessible to the controller.

Where the data subject chooses to register an account, login credentials and order history are processed. Registration is optional and it is always possible to check out as a guest.

The online store neither requests nor collects special categories of data within the meaning of Article 9 GDPR. Users are asked not to enter data of that nature in free-text fields.

Data relating to cookies and similar technologies

Cookies are small strings of text that the websites visited place on users’ devices in order to improve browsing and, where applicable, to monitor use of the site. Some cookies may be sent back to the same website on subsequent visits, allowing the user to be recognised and improving the functionality of the site. While browsing, users may also receive on their device cookies sent by other websites or servers (known as "third-party" cookies).

The online store uses technical cookies that are necessary to ensure safe and efficient browsing, to maintain the contents of the basket, to store language and currency preferences and to complete the purchase process. These cookies do not require the data subject’s consent.

On first access to the website, users and visitors may give or refuse their consent to the installation of non-technical cookies by means of the relevant banner. Non-technical cookies — including profiling cookies and non-anonymised traffic analysis cookies — are installed and activated solely following the user’s consent, given through the preference management tool available on the website; in the absence of such consent, these tools remain disabled. Consent may be changed or withdrawn at any time and from any page of the website through the same tool.

The complete and up-to-date Cookie Policy, including the list of all cookies in use together with their purposes, duration and the identity of the third-party providers, is available at https://boutique.ilsanpietro.it/pages/cookie-policy and through the cookie preference centre available on the website.

Links to third-party websites

The controller reserves the right to use and/or feature third-party services on its website. As regards the processing of personal data, the websites of such parties may apply different and independent criteria. The controller therefore accepts no responsibility for the activities and contents of linked third-party websites.

The online store links to the Hotel’s corporate website ilsanpietro.com, operated by the same controller, whose processing activities are described in the privacy policy published there.

Transfers of data to third countries

The online store delivers to Italy, the European Union, the United Kingdom, the United States of America and other countries.

Transfers of personal data to third countries connected with the services of the suppliers listed under "Data controller and place of processing" take place on the basis of an adequacy decision of the European Commission, where applicable, or of Standard Contractual Clauses pursuant to Article 46 GDPR, supplemented by the additional measures provided for in the data processing agreements entered into with each supplier.

Where delivery is requested to a country outside the European Economic Area, the data necessary for shipment and customs formalities is disclosed to the carrier and to the authorities of the country of destination. That transfer is necessary for the performance of the contract entered into at the data subject’s request and is made pursuant to Article 49(1)(b) GDPR. Please note that such countries may not ensure a level of protection of personal data equivalent to that guaranteed within the European Union and that, in those cases, the appropriate safeguards provided for in Article 46 GDPR may not apply.

A copy of the safeguards adopted may be obtained by writing to the contact details given under "Rights of data subjects".

Automated decision-making

The controller does not carry out decision-making based solely on automated processing which produces legal effects concerning the data subject or similarly significantly affects them within the meaning of Article 22 GDPR. As part of fraud prevention, the platform and the payment service provider may apply automated tools to assess the risk associated with a transaction; any refusal of an order is not, however, taken solely on the basis of such an assessment.

Minors

The online store is not intended for persons under the age of eighteen and purchases are reserved to those who have the capacity to enter into contracts under the applicable law. The controller does not knowingly collect personal data relating to minors. Any person exercising parental responsibility who believes that a minor has provided personal data may report this to the contact details given under "Rights of data subjects": the data will be erased without delay.

Optional nature of providing data

Apart from what is specified in relation to browsing data, users and visitors are free to choose whether or not to provide their personal data. Providing identification, contact, billing and delivery details is nevertheless necessary in order to enter into and perform the contract of sale: without it, the order can be neither accepted nor fulfilled. Providing the data required for tax obligations is mandatory by law. Failure to provide other data may result only in the requested service or reply not being available. Refusing consent to non-technical cookies does not affect the ability to browse the website and to make purchases.

Processing methods and retention

All processing is carried out by automated means (for example using electronic procedures and media) and/or manually (for example on paper) for no longer than is necessary to achieve the purposes for which the data was collected and, in any event, in accordance with the legislation in force.

In particular: browsing data and technical logs generated by the operation of the online store are retained by the platform supplier for the periods set out in its own contractual terms and privacy notice, to which reference is made, and in any event for no longer than is necessary for the purposes of the functioning and security of the website, save where required for the detection of criminal offences; data relating to orders, payments and deliveries, together with tax and accounting records, is retained for 10 years in accordance with civil-law and tax obligations; customer account data is retained until the data subject requests erasure or the account is closed and, in the absence of logins and orders, for no longer than 24 months from the last interaction, subject to prior notice; support correspondence not relating to an order is retained for 24 months from the last contact; data processed in order to establish, exercise or defend legal claims is retained for the duration of the proceedings and until the time limits for appeal have expired; the consent given in relation to cookies and its duration are set out in the Cookie Policy.

For processing carried out by third-party suppliers appointed as data processors, retention periods are governed by the relevant contractual agreements and by the privacy notices of the individual suppliers, to which reference is made.

Once the periods indicated have expired, the data is erased or irreversibly anonymised, unless a legal provision requires it to be retained for longer.

Specific security measures are implemented in order to prevent loss of data, unlawful or improper use and any unauthorised access.

Rights of data subjects

Under Articles 15 to 22 GDPR, data subjects have the right, at any time and within the limits laid down by the legislation in force, to obtain confirmation as to whether their data is being processed and to access that data and the following information:

  • the purposes of the processing;

  • the categories of personal data processed;

  • the recipients or categories of recipient to whom the data has been or will be disclosed, in particular where they are located in third countries or are international organisations;

  • the envisaged retention period or, where this is not possible, the criteria used to determine it;

  • all available information as to the source of the data, where it has not been collected directly from the data subject;

  • the existence of automated decision-making, including profiling.

Data subjects also have the right to obtain from the data controller, without undue delay:

  • the rectification of inaccurate personal data;

  • the completion of incomplete personal data, including by means of a supplementary statement;

  • the erasure of their personal data (within the limits and in the cases provided for by the applicable legislation);

  • the restriction of processing;

  • the right to object at any time to the processing of their personal data (Article 21 GDPR), where the processing is based on the controller’s legitimate interest or is carried out for direct marketing purposes;

  • the right to withdraw at any time any consent given, without affecting the lawfulness of processing carried out before its withdrawal (Article 7 GDPR);

  • the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), Piazza Venezia 11, 00187 Rome – www.garanteprivacy.it – certified email: garante@gpdp.it.

Data subjects also have the right to receive from the controller the personal data concerning them in a structured, commonly used and machine-readable format and to transmit it to another controller without hindrance (data portability, Article 20 GDPR), where technically feasible.

Requests may be sent directly to the data controller at assistant@ilsanpietro.it . Data subjects may also contact the Data Protection Officer (DPO) directly at dpo.ilsanpietro@figurati.it.

This document, published at boutique.ilsanpietro.it, constitutes the Privacy Policy of this website and may be updated from time to time. Use of the information collected is subject to the policy in force at the time of use.

revised in September 2026