Information on the processing of personal data pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR)

Last updated: 6 August 2026

1. Data Controller

The Data Controller is Grafica Veneta S.p.A., with registered office at Via Malcanton 2, 35010 Trebaseleghe (PD), Italy – VAT no. 01077550281 – REA PD-177633.

For any request relating to the protection of personal data: privacy@royalnotes.it

2. Data Collected and Purposes of Processing

Personal data collected through www.royalnotes.it is processed for the following purposes:

a) Performance of the contract and provision of services (Art. 6.1.b GDPR)
Order management, shipping, returns, payments, product personalisation (initial embossing), customer account management, customer support, corporate orders. Providing data for this purpose is necessary: without it, the purchase or service cannot be completed.

b) Compliance with legal obligations (Art. 6.1.c GDPR)
Accounting, tax and regulatory obligations.

c) Direct marketing (Art. 6.1.a GDPR – with prior consent)
Sending commercial communications, newsletters ("Royal Circle") and personalised offers by email. Consent is optional and may be withdrawn at any time.

d) Responding to contact requests (Art. 6.1.b GDPR)
Handling enquiries submitted through the contact form.

e) Browsing data and cookies (Art. 6.1.a GDPR – with prior consent for non-essential cookies)
The website uses technical cookies (essential for operation) and, with prior consent, analytics, marketing and profiling cookies. For the full list, purposes and consent management methods, please refer to the Cookie Policy.

3. Categories of Data Processed

Identification and contact data (name, surname, email, phone, shipping and billing address); product personalisation data (initials for embossing); payment data (managed by third-party processors – the Controller does not store card details); browsing data (IP address, browser, operating system, pages visited, time spent); purchase data (products purchased, amounts, dates, returns).

4. Recipients and Data Processors

Data may be shared with the following categories of recipients, appointed as data processors pursuant to Art. 28 GDPR where applicable:

• Shopify Inc. – e-commerce platform (hosting, order management, checkout, payments)
• Klaviyo Inc. – email marketing and automation platform
• Meta Platforms Inc. – advertising campaigns and remarketing (Meta Pixel)
• Microsoft Corporation – analytics and session recording (Microsoft Clarity)
• Klarna AB – instalment payment services
• PayPal (Europe) S.à r.l. et Cie, S.C.A. – payment services
• Carriers (Poste Italiane, BRT, DHL or others) – shipping and delivery

Data will not be disclosed indiscriminately under any circumstances.

5. Transfer of Data Outside the EU/EEA

Some of the recipients listed above are based in the United States or in other countries outside the EU/EEA. Transfers are carried out on the basis of:

• Adequacy decision by the European Commission – EU-U.S. Data Privacy Framework (DPF) for certified providers (Shopify, Meta, Klaviyo, Microsoft);
• Standard Contractual Clauses (SCCs) adopted by the European Commission pursuant to Art. 46.2.c GDPR, where the DPF is not applicable.

You may request a copy of the safeguards adopted by writing to privacy@royalnotes.it.

6. Retention Periods

• Order data: 10 years from the date of the order (accounting and tax obligations under Art. 2220 of the Italian Civil Code).
• Customer account data: until the account is deleted by the user, and subsequently for the period necessary to protect the Controller's rights.
• Marketing data: until consent is withdrawn, and in any case no later than 24 months from the last interaction.
• Browsing data and cookies: for the duration indicated in the Cookie Policy.
• Contact form data: 12 months from the request.
• Returns and complaints data: 26 months from the date of return/complaint.

7. Your Rights

You have the right to:

• Access (Art. 15 GDPR): obtain confirmation of processing and access your data;
• Rectification (Art. 16 GDPR): correct inaccurate data or complete incomplete data;
• Erasure (Art. 17 GDPR): have your data deleted, where provided for by law;
• Restriction (Art. 18 GDPR): restrict processing;
• Portability (Art. 20 GDPR): receive your data in a structured, machine-readable format;
• Objection (Art. 21 GDPR): object to processing on legitimate grounds, including direct marketing;
• Withdrawal of consent (Art. 7.3 GDPR): withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise your rights, please write to: privacy@royalnotes.it

The Controller will respond within 30 days of receiving the request.

8. Right to Lodge a Complaint

You have the right to lodge a complaint with the competent supervisory authority. In Italy: Garante per la protezione dei dati personali – www.garanteprivacy.it – Piazza Venezia 11, 00187 Rome.

9. Changes to This Policy

The Controller reserves the right to update this policy. Changes will be published on this page with the date of last update. Users are encouraged to review this page periodically.