Last Updated: March 6, 2025

Welcome to our Privacy Policy. This document explains how we collect, use, and protect your personal data when you use our online store and services. We are committed to protecting your privacy and handling your data in an open and transparent manner in compliance with Regulation (EU) 2016/679 (General Data Protection Regulation or GDPR).

1. Data Controller

We are the "Titolare del Trattamento" (Data Controller) of the personal data you provide to us, as defined by Art. 4(7) of Regulation (EU) 2016/679 (GDPR) and Art. 4(1)(f) of the Italian Privacy Code (Legislative Decree 196/2003 as amended by Legislative Decree 101/2018).

2. Personal Data We Collect

We collect personal data when you use our website:

• Data You Provide: Name, email, address, phone, payment details, order history.
• Automatically Collected Data: IP address, device info, browser type, site interactions.
• Cookies: Used for analytics and enhancing user experience.

For detailed information about cookies, please see our Cookie Policy which explains the types of cookies we use, their purpose, and how you can control them. (As required by Art. 122 of the Italian Privacy Code and the Italian Data Protection Authority's Guidelines on Cookies and Tracking Tools)

3. Legal Basis for Processing

• Contract: Order processing, customer service (Art. 6(1)(b) GDPR).
• Legal Obligation: Tax compliance, consumer laws (Art. 6(1)(c) GDPR, including Italian fiscal requirements under D.P.R. 633/72).
• Legitimate Interest: Fraud prevention, service improvement (Art. 6(1)(f) GDPR).
• Consent: Marketing communications (Art. 6(1)(a) GDPR and Art. 130 of the Italian Privacy Code).

4. How We Use Your Data

• Processing orders, managing accounts.
• Improving services and analyzing website usage.
• Sending updates, responding to inquiries.
• Marketing communications (with appropriate legal basis).

For any processing based on consent, you have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. (Art. 7(3) GDPR)

5. Data Sharing

• With Service Providers: Payment, shipping, cloud storage.
• For Legal Compliance: Government authorities if required.
• Business Transfers: In case of mergers or acquisitions.

When we share data with service providers, they act as "Responsabili del Trattamento" (Data Processors) under Art. 28 GDPR, and we ensure appropriate contractual safeguards are in place.

6. International Data Transfers

Some data may be processed outside the EEA with proper safeguards in place, such as:

• EU Standard Contractual Clauses (Art. 46(2)(c) GDPR)
• Adequacy decisions by the European Commission (Art. 45 GDPR)
• Other appropriate safeguards as required by Chapter V of the GDPR

7. Data Security

We implement encryption, secure access controls, and regular security assessments to protect your data. We have implemented appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as required by Art. 32 GDPR.

8. Data Retention

Data is retained based on legal and business requirements:

• Orders: Retained for warranty and tax compliance (minimum 10 years as required by Art. 2220 of the Italian Civil Code).
• Marketing: Until you withdraw consent.
• Account information: As long as your account remains active, plus any period required by law.

9. Your Rights

• Access: Request a copy of your data (Art. 15 GDPR).
• Rectification: Correct inaccurate information (Art. 16 GDPR).
• Erasure: Request deletion under specific conditions (Art. 17 GDPR).
• Restriction: Limit data processing (Art. 18 GDPR).
• Portability: Receive data in a transferable format (Art. 20 GDPR).
• Objection: Object to processing under certain circumstances (Art. 21 GDPR).
• Withdraw Consent: For processing based on consent (Art. 7(3) GDPR).
• Lodge a Complaint: With the Italian Data Protection Authority (Garante per la protezione dei dati personali) at www.garanteprivacy.it.

To exercise your rights, please contact us using the details provided below. We will respond to your request within one month, as required by the GDPR. This period may be extended by two further months where necessary, taking into account the complexity and number of requests.

10. Automated Decision-Making and Profiling

We do not make decisions solely based on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

11. Children's Privacy

Our services are not directed to individuals under 16 years of age. We do not knowingly collect personal data from children. If you become aware that a child has provided us with personal data, please contact us.

12. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices or for operational, legal, or regulatory reasons. We will notify you of any material changes through our website or by email.

13. Contact Us

We are committed to protecting your data. Thank you for trusting FlowPerformance Suspension.