Privacy Policy
This policy explains, under Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”), how we process the personal data of visitors to mytiboo.com (the “Site”) and of customers who buy Tiboo products.
1. Data controller
BYTE S.R.L., Via Casale 16, 10060 Scalenghe (TO), Italy, VAT no. IT12199130019.
For any privacy request: support@mytiboo.com · PEC: byte-srl@pec.it.
We have not appointed a Data Protection Officer (DPO), as this is not mandatory for our activities.
2. What data we process
- Browsing and security data: IP address, browser and device type, date and time, pages requested and the outcome of the request, collected by the systems that run the Site and protect it from abuse.
- Order data: first and last name, email, phone number, delivery and billing addresses, company name, VAT number or tax code, Italian SDI code or PEC (if provided), products purchased, amounts and language. You enter this data on the Stripe payment page and we receive it to fulfil your order.
- Payment data: collected and processed by Stripe. We only receive limited information (for example the payment outcome, card type and last digits), never the full card number.
- Communications: messages you send us by email (support, returns, guarantee) and, for the Custom Shield, the descriptions, images and material you provide.
- Statistical data (only with your consent): online identifiers stored in Google Analytics cookies, pages visited, device information and approximate city-level location derived from the IP address, which Google Analytics 4 does not store.
3. Purposes, legal bases and retention
| Purpose | Legal basis | Retention |
|---|---|---|
| Managing orders, payments, production, shipping, customer service, returns and guarantee claims | Performance of the contract (Art. 6(1)(b) GDPR) | For the duration of the relationship and then up to 10 years, to protect our rights within limitation periods |
| Making your Custom Shield (material you send us) | Performance of the contract (Art. 6(1)(b)) | Up to 26 months from delivery (legal guarantee period), then deleted |
| Tax and accounting obligations (invoices, records) | Legal obligation (Art. 6(1)(c)) | 10 years (Article 2220 of the Italian Civil Code and tax law) |
| Replying to requests sent by email | Pre-contractual measures or performance of the contract (Art. 6(1)(b)) or our legitimate interest in replying (Art. 6(1)(f)) | 24 months from the last message, unless needed for an order |
| Site security and prevention of fraud and abuse (for example request limits and technical logs) | Legitimate interest (Art. 6(1)(f)) | Technical logs: maximum 30 days, unless needed to investigate unlawful activity |
| Establishing, exercising or defending legal claims | Legitimate interest (Art. 6(1)(f)) | For as long as necessary and within limitation periods |
| Site usage statistics with Google Analytics | Consent (Art. 6(1)(a) GDPR and Article 122 of the Italian Privacy Code), which you can withdraw at any time | Cookies: 13 months. Data in Google Analytics reports: 14 months |
We do not use your data for marketing or profiling and we do not sell it. If we ever want to send you promotional messages, we will ask for your consent separately.
4. Is providing data required?
Order data is necessary to conclude and perform the contract: without it we cannot accept your order. Consent to statistics is optional, and refusing it has no effect on your use of the Site or on purchases.
5. Who we share data with
Data is processed by authorised staff of BYTE S.R.L. and shared only with the parties needed for the purposes above:
- Stripe Payments Europe, Limited (Dublin, Ireland): payment page, collection, receipts and invoices. For some activities, such as fraud prevention and anti-money-laundering obligations, Stripe acts as an independent controller: see Stripe’s privacy policy.
- Amazon Web Services EMEA SARL (Luxembourg): hosting of the Site on AWS Lightsail in the Frankfurt region (Germany), as data processor.
- Google Ireland Limited (Dublin, Ireland): Google Analytics, only with your consent, as data processor.
- Poste Italiane S.p.A.: delivery of products and shipment handling.
- The email service provider used for the support@mytiboo.com mailbox, as data processor.
- Tax and legal advisers bound by confidentiality, and public authorities where required by law.
Data is not published. The up-to-date list of data processors is available on request.
6. Transfers outside the European Economic Area
Some providers (in particular Google and Stripe, through their US companies) may process data outside the EEA. In these cases the transfer is based on the European Commission’s adequacy decision on the EU-U.S. Data Privacy Framework, for certified companies, and/or on the Standard Contractual Clauses approved by the Commission, with the related supplementary measures.
7. Your rights
You may at any time request access to your data, rectification, erasure, restriction of processing and portability, and you may object to processing based on legitimate interest (Articles 15–22 GDPR). You can withdraw your consent to statistics at any time using the “Cookie settings” link at the bottom of every page, without affecting the lawfulness of processing before withdrawal. To exercise your rights, write to support@mytiboo.com: we reply within one month.
You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with the supervisory authority of the EU country where you live or work.
8. Other information
- Automated decisions: we do not take decisions based solely on automated processing. Stripe uses automated fraud-risk assessment on payments; if a payment is declined you can contact us.
- Minors: purchases on the Site are reserved for adults (18+).
- Cookies: details are in the Cookie Policy.
- Changes: we may update this policy; the date of the latest version is shown at the top.