“Personal data” means information that identifies you or can reasonably be linked to you. It does not include anonymous or anonymised data. Depending on how you interact with the Services, we may process:

• Contact details — name, address, billing and shipping address, telephone number and email.
• Payment data — transaction details, payment method and confirmation, financial account data.
• Account data — username, password, preferences and settings.
• Transaction data — items viewed, added to your cart, purchased, returned or exchanged.
• Communications with us — information you include when you write to us.
• Withdrawal declarations — described in detail in section 05.
• Device information — browser, connection network, IP address and other identifiers.
• Usage information — how and when you interact with the Services.

Sources of data

• Directly from you when you create an account, make a purchase or contact us.
• Automatically through the Services, including through cookies and similar technologies.
• From our service providers when they process data on our behalf.
• From our partners or third parties.

• Providing and improving the Services — processing payments, fulfilling orders, arranging shipping, managing returns and exchanges, maintaining your account and personalising your shopping experience.
• Marketing and advertising — sending promotional communications and showing you advertisements, to the extent permitted by law.
• Security and fraud prevention — authenticating accounts, ensuring secure payments and identifying fraudulent or harmful activity.
• Communicating with you — customer support and management of the commercial relationship.
• Exercising the right of withdrawal — receiving and recording declarations, sending acknowledgements of receipt, managing returns and refunds, and retaining evidence of compliance.
• Legal reasons — meeting legal obligations and responding to requests from authorities.

We may disclose your personal data to third parties for legitimate purposes within the limits of this policy:

• To Shopify, providers and third parties performing services on our behalf: IT management, payments, analytics, support, storage, fulfilment and shipping.
• To commercial and marketing partners. You may object to sharing for targeted advertising by contacting us.
• When you authorise us to do so, for example to ship your products.
• To our affiliates or within our corporate group.
• In connection with corporate transactions, to meet legal obligations or to defend our rights and those of users.

The Services are powered by Shopify, which collects and processes data relating to your access and use. Data submitted to the Services may be transmitted to Shopify and to third parties located in countries other than your own.

We also use certain enhanced Shopify features that incorporate data from your interactions with our store, other merchants and Shopify itself. In these cases, Shopify acts as the data controller and responds directly to requests to exercise your rights.

Further information is available in Shopify’s Consumer Privacy Policy and the Shopify Privacy Portal.

When you exercise your right of withdrawal through the dedicated function at munkiyitaly.it/pages/recesso, your data is processed as follows.

Data you provide

Your full name, email address, order number, order or delivery date, a description of the goods covered by the withdrawal and, if you choose to provide it, the reason. Giving a reason is optional: withdrawal requires no justification, and omitting it does not affect the validity of the declaration.

Data generated by our systems

A unique declaration reference, the date and time of receipt, the full declaration text and its cryptographic hash (SHA-256), the result of the anti-bot check, browser type and a pseudonymised version of your IP address.

The cryptographic hash and receipt date and time serve to demonstrate, even later, that the declaration was transmitted at a particular time and has not subsequently been altered. The register is append-only: records are never modified or overwritten.

Purposes and legal bases

The mandatory data is necessary to process the declaration. You may nevertheless also withdraw by an explicit declaration sent to info@munkiyitaly.it or by post.

Data recipients

• Cloudflare, Inc. — infrastructure on which the function runs and the register is stored, and the anti-bot verification service. Data is stored on servers located in the European Union. Acts as a data processor.
• Brevo (Sendinblue SAS) — sending the emails containing acknowledgements of receipt. Data is processed on infrastructure located in the European Union. Acts as a data processor.
• Shopify — receives the declaration reference to associate it with the order, as described in section 04.

Retention periods

No security measure is perfect, and we cannot guarantee absolute security. We recommend using only secure channels to communicate confidential information to us.

Retention periods depend on several factors: the need to maintain your account, provide the Services, meet legal obligations, resolve disputes or enforce other agreements. The specific periods in section 05 apply to withdrawal declarations.

Withdrawal declaration data is stored on Cloudflare infrastructure in the European Union and encrypted during transmission; access to the register is protected by credentials reserved for the data controller.

Depending on where you live, you may exercise one or more of the following rights. They are not absolute: in some circumstances we may refuse a request to the extent permitted by law.

• Access — request access to the personal data we hold about you.
• Deletion — request its erasure. This right does not apply to data we must retain to comply with a legal obligation or defend legal claims, as in the case of withdrawal declarations.
• Correction — request rectification of inaccurate data.
• Portability — receive a copy of your data or request its transfer to a third party.
• Objection to targeted advertising — object to the sale or sharing of data for advertising purposes by contacting us.
• Communication preferences — unsubscribe from promotional emails at any time. You will continue to receive non-promotional emails concerning your account and orders.

If you live in the United Kingdom or the European Economic Area

• Objection and restriction — ask us to stop or restrict processing for certain purposes.
• Withdrawal of consent — withdraw it at any time without affecting the lawfulness of previous processing.

We will respect the Global Privacy Control preference if enabled in your browser, treating it as an objection request for that device. We do not recognise other “Do Not Track” signals.

You will not be discriminated against for exercising these rights. Before processing a request, we may need to verify your identity. You may appoint an authorised agent, whom we will ask to provide evidence of authorisation.

If you have a complaint about the processing of your data, contact us using the details below. You may also contact the competent supervisory authority.

In Italy, this is the Italian Data Protection Authority. A list of authorities in the European Economic Area is available on the EDPB website.

We may transfer, store and process your personal data outside your country of residence. Withdrawal declaration data, however, is stored on servers located in the European Union.

For transfers outside the European Economic Area or the United Kingdom, we rely on recognised mechanisms such as the European Commission’s Standard Contractual Clauses, unless the transfer is to a country deemed adequate.

The Services may contain links to third-party websites, for which we make no guarantees and accept no responsibility regarding privacy, security or accuracy. A link does not imply our endorsement of the content.

The Services are not intended for minors, and we do not knowingly collect personal data from minors. If you are the parent or guardian of a minor who has provided us with personal data, contact us to request deletion. We are not aware of any sharing or sale of data relating to individuals under 16.

We will update this policy from time to time to reflect changes in our practices or for operational, legal or regulatory reasons. We will publish the updated version on the website, change the last-updated date and give notice as required by law.

For questions about this policy or to exercise your rights, email info@munkiyitaly.it or contact us on WhatsApp at +39 379 309 3224.

For the purposes of applicable data protection laws, we are the controller of your personal data.