Privacy policy

Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR")

1. Data Controller

The Data Controller is:

BUILD YOUR SOUL SOCIETÀ A RESPONSABILITÀ LIMITATA (short form: BYS S.r.l.) Via del Perlar 26 — 37135 Verona (VR), Italy Tax Code and VAT no. 05196220239 — REA VR-477941 Certified email (PEC): bys.srl@pec.it Email: info@buildyoursoul.com Telephone: +39 393 627 2710

The Controller has not appointed a Data Protection Officer (DPO), as the statutory conditions requiring one do not apply.

2. What data we collect

Data you provide directly:

Identity and contact details: first name, surname, email address, telephone number, shipping and billing address
Tax details: tax code and, where you request an invoice, VAT number and recipient code or PEC address
Order data: products purchased, amounts, payment method used, purchase history
Account credentials, if you choose to register
The content of communications you send us (emails, contact forms, support or return requests)

Data collected automatically while you browse:

IP address, device type, browser and operating system
Pages visited, products viewed, duration of visit, referring website
Identifiers stored via cookies and similar technologies

Data we do not collect. We never have access to your full payment card details: the card number, expiry date and security code are processed directly by the payment provider in a secure environment.

We do not knowingly collect data relating to children under 14. If you believe this has occurred, please contact us and we will delete it.

3. Why we process your data and on what basis

Purpose	Legal basis	Provision of data
Processing your order: contract formation, payment, shipping, delivery, returns and refunds	Performance of a contract to which you are party (Art. 6(1)(b) GDPR)	Mandatory: without this data we cannot fulfil the order
Issuing and retaining tax and accounting records	Legal obligation (Art. 6(1)(c) GDPR)	Required by law
Responding to your support requests, enquiries or complaints	Pre-contractual measures or legitimate interest in providing support (Art. 6(1)(b) and (f) GDPR)	Optional
Managing your customer account, if you register	Performance of a contract (Art. 6(1)(b) GDPR)	Optional
Sending you our newsletter, news about new drops and event invitations	Your explicit consent (Art. 6(1)(a) GDPR)	Optional and revocable at any time
Sending you communications about products similar to those you have already purchased	Legitimate interest, within the limits of Art. 130(4) of Italian Legislative Decree 196/2003	You may object at any time, including on first receipt
Analysing use of the Site and measuring the effectiveness of advertising campaigns	Your consent, given via the cookie banner (Art. 6(1)(a) GDPR)	Optional and revocable
Ensuring the security of the Site and preventing fraud and abuse	Legitimate interest in protecting our business and our users (Art. 6(1)(f) GDPR)	—
Establishing, exercising or defending legal claims	Legitimate interest (Art. 6(1)(f) GDPR)	—

4. Who we share your data with

Your data may be processed by parties acting as Data Processors, appointed under Art. 28 GDPR, or as independent controllers, within the following categories:

E-commerce platform and hosting: Shopify International Ltd. / Shopify Inc., which hosts the Site and manages order and customer data
Payment providers: the schemes and institutions processing transactions (including Shopify Payments, PayPal, card schemes, Apple Pay, Google Pay), acting as independent controllers
Carriers and shipping services: the logistics operator consolidating carriers and the carrier appointed for delivery, to whom we disclose the data required to deliver your order
Electronic invoicing and digital archiving services
Accounting and tax advisers assisting the Controller
Email marketing service providers, for sending the communications you have subscribed to
Analytics and advertising providers: Meta Platforms Ireland Ltd. and Google Ireland Ltd., limited to data collected with your prior consent via the cookie banner
Public authorities and judicial bodies, where required by law

An up-to-date and complete list of Data Processors is available on request by writing to info@buildyoursoul.com.

We do not sell, rent or trade your data to third parties for their own commercial purposes.

5. Transfers outside the European Economic Area

Some providers may process data in third countries, in particular the United States and Canada.

In such cases, transfers take place on the basis of one of the safeguards set out in Chapter V of the GDPR:

an adequacy decision of the European Commission, where applicable to the country or to the provider's certification mechanism;
standard contractual clauses adopted by the European Commission, supplemented where necessary by additional measures.

You may request a copy of the safeguards in place by writing to info@buildyoursoul.com.

6. How long we keep your data

Category of data	Retention period
Order, contract, accounting and tax records	10 years from recording, pursuant to Art. 2220 of the Italian Civil Code and tax legislation
Customer account data	Until you delete your account or request deletion
Contact details used for newsletter and marketing purposes	Until consent is withdrawn or you object, subject in any event to periodic review of continued interest
Support correspondence and return requests	24 months from closure of the request
Data collected via cookies and similar technologies	For the periods set out in the Cookie Policy
Data required for the defence of legal claims	For the duration of the proceedings and until the expiry of any appeal periods

Once those periods have elapsed, data is deleted or permanently anonymised.

7. Your rights

You may exercise the following rights under Articles 15-22 GDPR at any time:

Access: obtain confirmation as to whether processing is taking place and receive a copy of your data
Rectification: have inaccurate data corrected or incomplete data completed
Erasure: have your data deleted in the cases set out in Art. 17
Restriction: request restriction of processing in the cases set out in Art. 18
Portability: receive your data in a structured, commonly used format, or have it transmitted to another controller
Objection: object to processing based on legitimate interest, and in any event and without giving reasons to the sending of marketing communications
Withdrawal of consent: withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal

How to exercise them. Write to info@buildyoursoul.com. We will respond within one month of receipt, extendable by two further months where the request is particularly complex, in which case we will inform you.

You can unsubscribe from the newsletter at any time using the link at the bottom of each communication.

Complaints. If you believe the processing of your data infringes applicable law, you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome — www.garanteprivacy.it), or to bring proceedings before the courts.

8. Automated decision-making

We do not carry out processing involving automated decision-making that produces legal effects concerning you or similarly significantly affects you, within the meaning of Art. 22 GDPR.

9. Security

We implement appropriate technical and organisational measures to protect data against unauthorised access, loss, alteration or disclosure, including encryption of communications via HTTPS, access controls on our management tools, and the selection of providers offering adequate compliance guarantees.