Notice: This is a convenience translation. The legally binding version is the Italian text (Informativa sulla Privacy). In case of any discrepancy, the Italian version shall prevail.

Privacy Policy

Last updated: [LAST_UPDATED_DATE]

This privacy policy describes how Irille Team (hereinafter "we", "our", or the "Data Controller") collects, uses, stores, and protects the personal data of users (hereinafter "you" or the "Data Subject") in connection with the Irille Store B2B commerce platform, in accordance with Regulation (EU) 2016/679 ("GDPR"), Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018 (Privacy Code), and all applicable data protection legislation.

This policy applies to all services provided through the Irille Store mobile application, including account registration, catalogue browsing, order placement, B2B business relationship management, and access to the restricted area.

1. Data Controller Identity

The Data Controller responsible for processing your personal data is:

Company name: Irille Team
DPO e-mail: privacy@irille.com

The Data Controller is responsible for ensuring that personal data is processed in compliance with applicable legislation and for responding to data subject requests regarding their rights.

2. Data Protection Officer (DPO) Contact Details

The Data Controller has appointed a Data Protection Officer (DPO) pursuant to Article 37 of the GDPR. The DPO may be contacted at the following:

E-mail: privacy@irille.com

The DPO is available to address any questions or requests concerning the processing of personal data and the exercise of rights under the GDPR. The DPO will respond within 30 days of receiving the request.

3. Purpose and Legal Basis for Data Processing (Art. 6 GDPR)

Personal data is processed for the following purposes, each with its corresponding legal basis:

Purpose	Legal Basis (Art. 6 GDPR)	Description
Account registration and management	Performance of a contract (Art. 6.1.b)	Creation and management of the user account, authentication, business profile management, and identity verification within the B2B platform.
Order processing and management	Performance of a contract (Art. 6.1.b)	Managing the full order lifecycle including processing, shipping, invoicing, cart management, returns, and after-sales support.
Direct marketing communications	Consent (Art. 6.1.a)	Sending newsletters, promotions, personalised offers, and commercial communications. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.
Marketing for similar products or services	Legitimate interest (Art. 6.1.f)	Sending communications about products or services similar to those previously purchased (soft opt-in), pursuant to Article 130(4) of the Italian Privacy Code. You may object at any time.
Analytics and service improvement	Legitimate interest (Art. 6.1.f)	Analysis of platform usage patterns to improve user experience, optimise features, and ensure service security. Data is aggregated and, where possible, anonymised.
Tax and legal obligations	Legal obligation (Art. 6.1.c)	Retention and processing of data to comply with tax, accounting, and regulatory requirements under Italian and European legislation, including anti-money laundering regulations.
Protection of legal rights	Legitimate interest (Art. 6.1.f)	Retention of data for the defence of legal claims or the management of disputes.

4. Categories of Personal Data Collected

In the course of your use of the Irille Store platform, we collect the following categories of personal data:

a) Identity data

First name and last name
Company name and VAT number (for B2B users)
Tax identification code (where required by law)

b) Contact data

E-mail address
Telephone number
Shipping address and billing address

c) Commercial data

Order and transaction history
Purchase preferences and cart contents
Favourites list
Information relating to commercial relationships with suppliers
Invoicing data

d) Device data

Device model, operating system, and version
Unique device identifiers
IP address
Application version
Language and timezone settings

e) Usage data

Access logs and in-platform browsing history
Interactions with application features
Application performance and error data
Notification preferences

We do not collect special categories of personal data (sensitive data) within the meaning of Article 9 of the GDPR, nor data relating to criminal convictions and offences under Article 10 of the GDPR.

5. Data Retention Periods

Personal data is retained only for the period strictly necessary to fulfil the purposes for which it was collected, in accordance with the principles of data minimisation and storage limitation under the GDPR.

Data Category	Retention Period	Justification
User account data	Duration of contractual relationship + 12 months after account closure	Performance of contract and legitimate administrative interest
Order and billing data	10 years from the end of the relevant financial year	Tax and accounting obligations under Italian Civil Code Art. 2220 and Presidential Decree 600/1973
Marketing data (consent-based)	24 months from consent collection, unless renewed	Italian Data Protection Authority (Garante) marketing guidelines
Similar-product marketing data (soft opt-in)	24 months from the last purchase	Article 130(4) of the Italian Privacy Code
Device and usage data	13 months from collection	EDPB and Garante guidelines on cookies and tracking
Access logs	6 months from recording	System security and fraud prevention
Data for legal defence	Until expiry of applicable limitation periods (generally 10 years)	Legitimate interest in defence of legal rights

Upon expiry of the applicable retention periods, personal data will be deleted or irreversibly anonymised.

6. Data Subject Rights (Articles 15-22 GDPR)

As a data subject, you are entitled to exercise the following rights in relation to your personal data by contacting the Data Controller or the DPO at the details provided in this policy:

Right of access (Art. 15): Obtain confirmation of whether your personal data is being processed, access the data itself, and receive information about the purposes, categories of data, recipients, and retention period.
Right to rectification (Art. 16): Obtain the correction of inaccurate personal data concerning you and the completion of incomplete personal data, including by providing a supplementary statement.
Right to erasure / right to be forgotten (Art. 17): Obtain the deletion of your personal data where the data is no longer necessary for the purposes for which it was collected, where you withdraw consent, where you object to processing, or where processing is unlawful.
Right to data portability (Art. 20): Receive your personal data in a structured, commonly used, and machine-readable format and transmit it to another controller without hindrance.
Right to restriction of processing (Art. 18): Obtain the restriction of processing where you contest the accuracy of the data, where processing is unlawful and you oppose erasure, where the Controller no longer needs the data but you require it for legal claims, or where you have objected to processing pending verification.
Right to object (Art. 21): Object at any time to the processing of your personal data based on the Controller's legitimate interest, including profiling. In the case of direct marketing, objection will result in the immediate cessation of processing for that purpose.
Right not to be subject to automated decision-making (Art. 22): Not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

To exercise your rights, please send a request to the DPO at: privacy@irille.com. The Data Controller will respond within 30 days of receiving the request, which may be extended by a further 60 days in case of complexity or volume of requests, with prior notification.

The exercise of rights is free of charge, except in cases of manifestly unfounded or excessive requests, for which a reasonable administrative fee may be charged.

7. Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, if you believe that the processing of your personal data infringes the GDPR or Italian data protection legislation, you have the right to lodge a complaint with the competent supervisory authority.

The Italian supervisory authority is:

Garante per la protezione dei dati personali (Italian Data Protection Authority)
Website: https://www.garanteprivacy.it
E-mail: garante@gpdp.it
Certified e-mail (PEC): protocollo@pec.gpdp.it
Telephone: (+39) 06 69677 1

If you reside or work in another EU Member State, you may alternatively lodge a complaint with the supervisory authority of the Member State where you habitually reside, work, or where the alleged infringement has occurred.

8. Automated Decision-Making and Profiling

Not applicable. At present, Irille Team does not employ decision-making processes based solely on automated processing, including profiling, which produce legal effects concerning the data subject or similarly significantly affect them, within the meaning of Article 22 of the GDPR.

Any product recommendation systems implemented on the platform are based on logic that is not exclusively automated and do not produce legal effects on data subjects. Should such processes be introduced in the future, this policy will be updated and, where required, specific consent will be obtained from the data subject.

9. International Data Transfers

Personal data is processed and stored within the European Economic Area (EEA). Should it become necessary to transfer personal data to third countries outside the EEA, Irille Team will ensure that such transfers comply with Chapter V of the GDPR by adopting one of the following safeguards:

Adequacy decision: The transfer takes place to a country that the European Commission has recognised as providing an adequate level of protection pursuant to Article 45 of the GDPR.
Standard Contractual Clauses (SCCs): In the absence of an adequacy decision, the transfer is carried out on the basis of standard contractual clauses approved by the European Commission pursuant to Article 46(2)(c) of the GDPR, as updated by Commission Implementing Decision (EU) 2021/914.
Binding Corporate Rules (BCRs): Where applicable, the transfer may take place on the basis of binding corporate rules approved by the competent supervisory authority.

In all cases, Irille Team will conduct a Transfer Impact Assessment to verify that the level of data protection in the third country is essentially equivalent to that guaranteed within the EU. The data subject has the right to obtain a copy of the safeguards adopted by contacting the DPO.

10. Cookie Policy Summary

The Irille Store platform, as a mobile application, does not use cookies in the traditional sense. However, equivalent tracking technologies may be employed for the following purposes:

a) Strictly necessary technologies

Authentication tokens and session management
Language preferences and application settings
Security data for fraud prevention

Legal basis: No consent required, as these are necessary for service operation.

b) Analytical technologies

Application performance analysis
Aggregate usage statistics
Error detection and reporting

Legal basis: Legitimate interest of the Controller, with the possibility of objection.

c) Marketing technologies (if activated)

Content personalisation
Promotional campaign effectiveness analysis

Legal basis: Consent of the data subject, revocable at any time through the application settings.

For detailed information about the tracking technologies used, you may consult the full cookie policy available in the application settings or contact the DPO.