Welcome to the GCDS S.r.l. website (the “Site”).

On this page, we provide you with the privacy notice pursuant to Article 13 of Regulation (EU) 2016/679 (the “GDPR”) regarding the processing of your personal data collected when you browse the Website and interact with its services.

This privacy notice applies solely to the Website and any related subdomains, and not to any other websites that may be accessed through hyperlinks or external links.

We invite you to read this information carefully before providing us with your personal data.

1. 1. DATA CONTROLLER

GCDS SRL , with registered office in Milan, Via Spartaco n.8, Tax Code and registration number in the Companies Register of Milan, Monza-Brianza and Lodi 09146210969, REAN MI-2071764 , is the data controller of the personal data collected through the Website. This includes the processing activities related to the management of the Site and your registration (personal account), the sale of products offered on the Website - including order fulfillment and after-sales support (e.g., returns and complaints)- as well as marketing and profiling purposes.

1. DATA PROTECTION OFFICER (DPO)

The Data Controller has appointed a Data Protection Officer (DPO), who can be contacted at the following email address: privacy@gcds.it.

 

1. 2. CATEGORIES OF PERSONAL DATA COLLECTED

1. Browsing data

Browsing the Site and accessing the related services involve the acquisition of some personal data relating to your browsing, such as, for example, the IP addresses or domain names of the computers you use to connect to the Site, the URI (Uniform Resource Identifier) addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the operating system and the IT environment you use. This information is not collected to be associated with identified interested parties, but by its very nature could, through processing and association with data held by third parties, allow such interested parties to be identified.

1. Personal data that you provide to us voluntarily

The Data Controller processes the personal data that you voluntarily provide when you register on the Site, access the related services (for example, the creation of a wish list), purchase a product, subscribe to the newsletter, or interact with the customer service, such as, for example, identification data, contact details, purchase-related data, and payment data.

1. Cookies

The Site uses so-called cookies. For further information on cookies and their use on the Site, please refer to the Cookie Policy page.

1. 3. PURPOSE, LEGAL BASIS AND RETENTION PERIOD

1. Your personal data will be processed by GCDS S.r.l for:

 

	PURPOSE	LEGAL BASIS	RETENTION PERIOD
A	Site Navigation: navigation data is processed to allow you to navigate the Site and access the related services and, in particular, to obtain anonymous statistical information on the use of the Site and the services offered, to check its correct functioning and for security reasons.	Legitimate interest of the Data Controller, pursuant to art. 6 par. 1 lett. f)	For the period necessary for the relevant processing
B	Registration on the Site (personal account): to allow you to create your personal account on the Site and access and use the related services (for example, the management of your wish list).	Execution of the contract or pre-contractual measures requested by you, pursuant to art. 6 par. 1 lett. b)	Until the User requests deletion of the account or, failing that, for 24 months from the time of the last access
C	New Product Availability Update: Feedback on your request for an update on the availability of the requested product on the Site	Execution of the contract or pre-contractual measures requested by you, pursuant to art. 6 par. 1 lett. b)	For a period of 3 months from the receipt of your request
D	Marketing: to send you, via email, SMS, social networks and other instant messaging apps, promotional communications (including the newsletter) relating to the Data Controller’s products, services, and events and/or market research surveys.	Your consent, pursuant to art. 6 par. 1 lett. a)	Until consent is revoked or, failing that, for 24 months from the date of the last interaction with the Data Controller .
E	Profiling: we will process your personal characteristics (gender, date of birth, etc.) and your purchase history in order to assess your level of satisfaction and send you personalized commercial and promotional communications.	Your consent. pursuant to art. 6 par. 1 lett. a)	Until consent is revoked or, failing that, for 12 months from the date of the last interaction with the Data Controller.
F	Sale of products: for the conclusion and performance of the sales contract for the products offered on the Site, including the management and fulfillment of purchase orders, the delivery of products, communications regarding any circumstances related to the order, payment management, and anti-fraud checks.	Execution of the contract or pre-contractual measures requested by you, pursuant to art. 6 par. 1 lett. b)	For the time necessary to fulfill the purchase order (without prejudice to any further retention, where necessary, for the purposes set out below).
G	After-sales support: for the management and handling of requests submitted by you in relation to products purchased on the Site, such as requests concerning returns, complaints, and refunds.	Execution of the contract or pre-contractual measures requested by you, pursuant to art. 6 par. 1 lett. b)	For the period of time necessary to handle your request (without prejudice to any further retention, where necessary, for the purposes set out below).
H	Compliance with legal obligations: for compliance with legal obligations (in particular, in relation to civil, tax, public security, banking, and personal data protection matters).	Compliance with legal obligations, pursuant to art. 6 par. 1 lett. c).	For the period required by applicable law. Billing data are retained for 10 years from the date of issuance of the invoice.
I	Legal disputes and prevention of unlawful acts: to defend or enforce a right of the Data Controller and/or to investigate and prevent fraud and other crimes or unlawful acts.	Legitimate interest of the Data Controller, pursuant to art 6. par.1, lett. f)	For the period necessary for the purpose for which the data are collected, in accordance with applicable law (for example, with regard to limitation periods).

1. 4. NATURE OF DATA PROVISION

The provision of data marked as mandatory (for example, the fields in the forms marked with an asterisk *) for the purposes referred to in paragraph 3, letters A), B), C), F), and G), is necessary to browse and register on the Site, use the related services, and purchase products. Failure to provide such data will make it impossible to obtain the requested products and services.

With regard to the marketing and profiling purposes referred to in paragraph 3, letters D) and E), the provision of data is optional. Any refusal to provide such data will prevent the Data Controller from processing the data you provide for these purposes, but will not prevent you from browsing and registering on the Site, purchasing products, and using the related services as provided for in paragraph 3, letters A), B), C), F), and G).

1. 5. TREATMENT METHODS

Your data will be processed by the Data Controller mainly through electronic and digital means.

Specific security measures are implemented to prevent data loss, unlawful or improper use, and unauthorized access. The Data Controller has adopted all appropriate security measures required by applicable law.

1. 6. CATEGORIES OF RECIPIENTS OF PERSONAL DATA AND DISSEMINATION OF DATA

For the pursuit of the purposes for which the data are collected, the Data Controller may make use of the following categories of entities to whom the data may be disclosed or who may become aware of such data as data processors or, where applicable, as independent data controllers:

• - providers of IT services, such as internet service, hosting, and cloud computing providers (including the provider of the e-commerce platform on which the Site is developed);
• - entities carrying out logistics, warehousing, promotion, and delivery activities for the Data Controller’s products and services;
• - entities providing customer support services;
• - entities managing international (cross-border) orders and the related customer service on behalf of the Data Controller;
• - firms and other entities providing assistance, consultancy, and services of, for example, a legal, tax, accounting, economic-financial, technical-organizational, data processing, or communication nature;
• - entities providing banking, financial, payment, insurance, and debt recovery services;
• - entities carrying out anti-fraud payment control activities;
• - subsidiaries, parent companies, affiliates, and associated companies;
• - public authorities and supervisory and control bodies.
  

The Site is developed on the e-commerce platform provided by Shopify, which processes personal data as a data processor on behalf of the Data Controller. The management of certain international orders and the related customer service may be entrusted to Global-e, according to the terms available on the Site.

The updated list of data processors is available upon specific request submitted to the Data Controller through the contact methods indicated in paragraph 1.

Exclusively for the purposes specified above, your personal data may also be accessed by internal personnel of the Data Controller who are authorized to process such data in accordance with their respective duties.

No data collected through the Site is subject to disclosure.

In order to offer you Klarna’s payment methods, we might in the checkout pass your personal data in the form of contact and order details to Klarna, in order for Klarna to assess whether you qualify for their payment methods and to tailor those payment methods for you. Your personal data transferred is processed in line with Klarna’s own privacy notice.

 

1. 7. DATA TRANSFER TO A THIRD COUNTRY AND/OR AN INTERNATIONAL ORGANIZATION

Your personal data may be transferred, for the purposes for which it is collected, to countries outside the European Economic Area (EEA), including the United States of America. Such transfers take place only where appropriate safeguards are in place, such as: an adequacy decision adopted by the European Commission (for example, the Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the EU-U.S. Data Privacy Framework, for certified entities); standard contractual clauses adopted or approved by the European Commission (Article 46(2)(c) and (d) of the GDPR); or binding corporate rules (Article 47 of the GDPR).

To obtain information or a copy of the safeguards adopted, you may contact the Data Controller as indicated in paragraph 1.

1.  8. SOCIAL BUTTONS AND WIDGETS

The Site also contains social buttons/widgets. These are in particular the icons of social networks, such as, for example, Facebook, Instagram, TikTok, YouTube e X (formerly Twitter) - which allow you to access the relevant social networks by clicking on the icon. Through these tools, you may, for example, share content or recommend products from the Site on social networks.

Following your click on the social buttons/widgets, the social network may collect data relating to your visit to the Site. As stated in the introduction, this privacy notice does not cover the processing of your data by the social network, for which you should refer exclusively to the privacy notice provided by the relevant social network.

Except in cases where you voluntarily share your data with the selected social networks by clicking on the social buttons/widgets, the Data Controller does not disclose or share any personal data with social networks.

1. 9. SOCIAL PAGES AND PROFILES OF THE DATA CONTROLLER

The Data Controller uses, for its Facebook page and Instagram profile, the statistical functions (so-called “Insights”) that provide aggregated data on users’ interactions with such pages.

With regard to this processing activity, the Data Controller acts as a joint controller together with Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The joint controllership agreement is available at the following link: https://www.facebook.com/legal/terms/page_controller_addendum. You can consult Meta’s privacy notice at the following link: https://www.facebook.com/privacy/policy.

1. 10. MINORS

The Site and the services are intended for the sale of products to adults. Therefore, the Data Controller does not intentionally collect personal data relating to individuals under the age of 18. By accessing the Data Controller’s services, you declare that you are of legal age. Products intended for children available on the Site may only be purchased by adults.

1. 11. RIGHTS OF INTERESTED PARTIES

In relation to the personal data you have provided, you have the right, at any time, to:

1.  To exercise these rights, you may write to: privacy@gcds.it. You may also exercise your rights towards the Data Controller by writing to the contact details indicated in paragraph 1.

 

1. You may also withdraw your consent through the personal section of your account and through the link included in each marketing communication received from the Data Controller.

Finally, please note that, where the relevant conditions are met, you also have the right to lodge a complaint with the Data Protection Authority (Garante per la protezione dei dati personali), as the competent supervisory authority (www.garanteprivacy.it), in accordance with the applicable procedures.

Last updated on 24 June 2026