Privacy Policy
Last updated: July 21, 2026
This privacy notice describes how BOTTEGA DI SGUARDI S.R.L. collects and processes the personal data of users who visit the website www.bottegadisguardi.com, use its services or make a purchase, pursuant to Regulation (EU) 2016/679 (“GDPR”), Legislative Decree 196/2003, as amended by Legislative Decree 101/2018, and applicable law.
1. Data Controller
BOTTEGA DI SGUARDI S.R.L.
Registered office: Via Guglielmo Marconi 19 F/R, 50131 Florence (FI), Italy
VAT number and Tax Code: 06901730488
European VAT number: IT06901730488
REA: FI-664787
Certified email: dentro@pec.it
Email: info@bottegadisguardi.com
The Data Controller may be contacted using the details provided above for any requests relating to the processing of personal data and the exercise of the data subject’s rights.
2. Categories of personal data processed
Depending on how the website is used, the Data Controller may process the following categories of personal data:
- identification and contact data, such as first name, last name, email address, phone number, shipping address and billing address;
- order-related data, such as products purchased, amounts, delivery method, return, withdrawal, refund, support and warranty requests;
- tax data, such as tax code, VAT number, business name or legal name, recipient code and certified email address (PEC), when required for invoicing;
- payment data, such as payment method, outcome and transaction references. Full payment card details are processed directly by payment service providers and are not stored by Bottega di Sguardi;
- customer account data, such as the email address associated with the profile, order history and requests submitted through self-service features;
- data voluntarily provided through forms, emails, support requests or other contact channels;
- technical and browsing data, such as IP address, device type, browser, operating system, pages visited, date and time of access, technical logs and online identifiers;
- data relating to preferences and consents, including consents relating to cookies, tracking tools, newsletters and promotional communications;
- data used for security and fraud prevention, to the extent permitted by applicable law.
The Controller asks users not to submit personal data beyond what is necessary for the purpose of their request.
3. Optical prescriptions and health data
When the Customer requests prescription glasses, Bottega di Sguardi may process the data contained in the optical prescription and the visual parameters necessary to make, check, deliver and fit the requested product.
Such information may fall within the special categories of personal data set out in Article 9 of the GDPR. Processing takes place only when necessary to provide the requested product or service and when one of the conditions set out in Article 9(2) of the GDPR applies, including, where necessary, the explicit consent of the data subject.
Data are accessible only to authorized personnel and any professionals, laboratories or suppliers involved in processing, to the extent strictly necessary.
The Customer must submit only prescriptions and information relating to themselves or to people they are authorized to act on behalf of.
4. Purposes of processing, legal bases and retention
4.1 Order management and contractual relationship
Data are processed to:
- manage the cart, order and payment;
- check product availability;
- prepare, ship or make the order available for collection;
- send communications relating to the purchase;
- handle returns, cancellations, refunds, complaints, support and warranties;
- make personalized products and prescription glasses.
Legal basis: performance of the contract or pre-contractual measures requested by the data subject. Any special categories of data are also subject to the conditions set out in Article 9 of the GDPR.
Retention period: for the time necessary to perform the contract and subsequently for the period required by legal obligations or necessary to protect the rights of the Controller and the data subject.
4.2 Administrative, tax and accounting obligations
Data are processed for invoicing, bookkeeping, tax compliance and other legally required obligations.
Legal basis: compliance with legal obligations.
Retention period: for the period required by applicable tax, accounting and civil law, generally ten years, unless longer periods are required by law or necessary in the event of a dispute.
4.3 Customer account creation and management
Data are processed to enable access to the profile, view orders, and use available features, including self-service procedures.
Legal basis: performance of the contract or measures requested by the data subject.
Retention period: until the account is deleted, without prejudice to retaining data necessary for orders already placed, legal obligations, or protection of rights.
4.4 Assistance and responding to requests
Data are processed to respond to questions, requests for information, complaints, and communications sent by the user.
Legal basis: performance of pre-contractual measures, performance of the contract, or the Controller’s legitimate interest in handling received requests.
Retention period: for the time necessary to handle the request and, subsequently, for the period necessary to protect the rights of the parties.
4.5 Security, fraud prevention, and protection of rights
Data may be processed to ensure the security of the site and transactions, prevent unlawful or fraudulent use, establish liability, and protect the rights of the Controller, users, or third parties.
Legal basis: the Controller’s legitimate interest and, where applicable, compliance with legal obligations.
Retention period: for the time necessary to verify and handle the dispute or any related proceedings.
4.6 Newsletters and promotional communications
With consent, contact details may be used to send newsletters, news, invitations, content, and promotional communications relating to Bottega di Sguardi.
Legal basis: the data subject’s consent.
Retention period: until consent is withdrawn or deletion is requested, without prejudice to retaining information necessary to demonstrate that consent was previously given.
L’data subject may withdraw consent at any time using the link in the communications or by writing to info@bottegadisguardi.com.
4.7 Analytics, personalization, and advertising
With consent, the site may use cookies and other tracking tools to analyze site usage, measure performance, personalize content, measure advertising campaigns, and deliver relevant communications or ads.
Legal basis: the data subject’s consent, except for processing strictly necessary for the operation and security of the site.
Retention period: according to the duration of each tool specified in the preferences panel and the Cookie Policy managed through Consentmo GDPR Compliance.
5. Nature of data provision
Providing the data indicated as necessary is essential to place an order, receive products, obtain support, or use the requested service.
Failure to provide the data may make it impossible to conclude or perform the contract.
Providing data for newsletters, marketing, non-essential analytics, personalization, and advertising is optional. Refusing or withdrawing consent does not prevent access to the site’s essential features or the ability to make purchases.
6. Processing methods and security measures
Processing is carried out using IT, electronic, and, when necessary, paper-based tools, in accordance with the principles of lawfulness, fairness, transparency, data minimization, and storage limitation.
The Controller adopts appropriate technical and organizational measures to protect personal data from loss, unauthorized access, disclosure, alteration, or destruction.
However, no IT system can guarantee absolute security. L’users are encouraged to use secure devices and protect their credentials and access codes.
7. Data recipients
Data may be disclosed or made accessible, to the extent necessary, to the following categories of recipients:
- the Controller’s authorized personnel and collaborators;
- Shopify, as the provider of the e-commerce platform, hosting, checkout, customer accounts, and related technological functions;
- Consentmo, provided by iSenseLabs, for managing the cookie banner, preferences, consents, and privacy requests;
- payment service providers;
- couriers, logistics operators, and pickup points;
- laboratories, opticians, technicians, and suppliers involved in the production or customization of products;
- IT, maintenance, security, email, and support service providers;
- newsletter, marketing, analytics, and advertising providers, when these services are active and in accordance with the preferences expressed by the user;
- accountants, consultants, lawyers, banking institutions, and insurance companies;
- public authorities, law enforcement agencies, and other parties to whom disclosure is required by law.
Providers that process personal data on behalf of the Controller are appointed as processors when required by Article 28 of the GDPR.
L’The updated list of processors can be requested from the Controller.
8. Shopify
The site and online store are built on the Shopify platform.
Shopify processes the personal data necessary to provide e-commerce technology services, including hosting, infrastructure, checkout, order management, customer accounts, security, and fraud prevention.
Depending on the different activities, Shopify may act as a processor on behalf of the Seller or, in the cases specified in its documentation, as an independent controller.
For more information about Shopify's processing, you can consult its privacy notice at Shopify Privacy Policy.
9. Consentmo GDPR Compliance
The site uses the Shopify app Consentmo GDPR Compliance, provided by iSenseLabs, to:
- display the cookie banner and preferences panel;
- collect, record, and manage the user's choices;
- allow acceptance, rejection, or selection of non-essential cookie categories;
- block or activate tracking tools based on the preferences expressed, within the limits of the site's technical configuration;
- manage the privacy functions and requests configured by the Controller.
Consentmo may process technical data necessary to record and demonstrate the preferences expressed, such as the date and time of access, browser and device information, anonymized IP address, and records of acceptance or rejection choices.
The service is provided by:
iSenseLabs, operating as Consentmo
4 Prof. Georgi Bradistilov Street
1700 Sofia, Bulgaria
EU registration number: 112660079
Email: support@consentmo.com
For more information, you can consult the Consentmo Privacy Policy.
L’user may change or withdraw their preferences at any time using the “Cookie Preferences” button or link available on the site.
10. Cookies and other tracking tools
The site uses cookies and similar technologies. Some are strictly necessary for the store to function, for security, the cart, checkout, accounts, and storing privacy preferences, and do not require consent where provided for by law.
Cookies and tools intended for non-essential statistics, personalization, or advertising are used only after consent has been given, where required.
L’the updated list of cookies and tools actually detected, organized by category, provider, purpose, and duration, is available in the Cookie Policy and in the preferences panel managed through Consentmo.
Categories may include:
- necessary cookies, essential for the functioning of the site and store;
- preference cookies, used to remember settings and choices;
- statistical or analytics cookies, used to understand how the site is used;
- marketing cookies, used to measure campaigns, personalize ads, and recognize users across different sites or platforms.
Simply continuing to browse does not constitute consent to the use of non-essential cookies.
L’the user may reject non-essential cookies without losing access to the site's essential functions.
11. Transfers of data outside the European Economic Area
Some providers, including Shopify and other technology services that may be used, may process personal data in countries outside the European Economic Area.
Where necessary, transfers are made on the basis of an adequacy decision by the European Commission, standard contractual clauses approved by the European Commission, or another mechanism provided for under Articles 44 et seq. of the GDPR.
L’the data subject may request further information about the safeguards applied by contacting the Controller.
12. Data subject rights
In the cases provided for by the GDPR, the data subject may:
- obtain confirmation as to whether or not their data is being processed;
- access personal data and receive a copy;
- request rectification or updating of inaccurate or incomplete data;
- request erasure of the data;
- request restriction of processing;
- object to processing based on legitimate interests;
- object to direct marketing at any time;
- receive the data in a structured, commonly used, machine-readable format and, where applicable, have it transmitted to another controller;
- withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal;
- not to be subject to a decision based solely on automated processing that produces legal effects or significantly affects them, in the cases provided for by law;
- lodge a complaint with the competent supervisory authority.
13. Exercising Your Rights
Requests can be sent to:
Email: info@bottegadisguardi.com
Certified email: dentro@pec.it
The Controller may request the information necessary to verify the requester’s identity and will respond within the time limits established by applicable law.
Requests are free of charge, except in cases of manifestly unfounded or excessive requests as provided for by the GDPR.
14. Complaints to the Italian Data Protection Authority
L’data subject who believes that the processing of their personal data violates applicable law may lodge a complaint with the Italian Data Protection Authority or apply to the competent judicial authority.
Information on how to file a complaint is available on the institutional website www.garanteprivacy.it.
15. Minors’ Data
The website and online sales services are not intended for anyone under 18 years of age.
The Controller does not knowingly collect minors’ personal data to allow them to make purchases on the website independently.
If a parent or guardian believes that a minor has submitted personal data without authorization, they may contact the Controller to request that it be verified and, where applicable, deleted.
16. Links and Third-Party Services
The website may contain links, content, or features provided by third parties.
When users interact with these services, third parties may process personal data in accordance with their own privacy notices and as independent data controllers.
L’users are invited to consult the privacy notices of third parties before using their services.
17. System Logs and Maintenance
For operational, maintenance, and security purposes, the website and technical service providers may collect system logs containing data such as IP address, date and time of access, requests made, errors, and information about the device or browser.
These data are processed to ensure the proper functioning of the services, prevent abuse, diagnose problems, and protect security.
18. Changes to the Privacy Policy
The Controller may amend or update this Privacy Policy to reflect regulatory, technical or organizational changes.
The updated version will be published on this page, indicating the date of the last update.
Where required by law, the Controller will inform data subjects by additional means or obtain consent again.