privacy policy | forte

who is the data controller?

forte_forte s.r.l., with registered office at via dell'industria, 22/24/26/28/30/32 – 36030 sarcedo (vi) (vat number: 02976310249) (hereinafter, the "data controller")

how can i contact the data controller?

the company's contact details are:

certified email address: forteforte@legalmail.it

address: via dell'industria, 22/24/26/28/30/32 – 36030 sarcedo (vi)

1. introduction

pursuant to the european general data protection regulation (gdpr), legal persons are not considered data subjects and therefore the european regulation does not apply. however, if personal data relating to a natural person are entered in the context of the collection of company data, the natural person shall be considered a data subject pursuant to the aforementioned regulation, with the consequent applicability of the relevant legislation.

2. what processing is carried out through the website? and what are the legal bases, purposes and retention periods?

_ registration

purpose

the purpose of data processing is to register on the website and be able to make purchases more easily, keep track of the order history and independently manage certain aspects relating to shipments.

legal basis

consent.

retention periods

in the event that the account remains inactive for 3 years, we will send you an email to find out if you are still interested in keeping it active; otherwise, the account will be deleted.
the data will be processed for a longer period in the event of a dispute.

other information

the provision of data is not mandatory, as it is also possible to make purchases in "guest" mode.

registration via social media

on the website, there is the option to register via social media. therefore, the data will not be provided directly by the data subject but imported from the social network used (meta) and then processed pursuant to article 14 of the gdpr. the data processed are: personal data and email address.

_ purchase

purpose

the main purpose of the data processing is to allow the user to purchase and receive the requested product and, in addition, the data is necessary for the fulfilment of legal obligations (including those of an accounting and tax nature).

the data could be used in the event of disputes raised regarding the correct fulfilment of the contract.

legal basis

performance of a contract and consequent fulfilment of the legal obligations incumbent on the data controller.

in the event of a dispute, the data will be processed in order to take legal action or defend oneself in court, and this corresponds to the legitimate interest of the data controller.

retention periods

the data will be deleted 10 years after the fulfilment of the contract.

it may be kept for longer only in the event of disputes and therefore to exercise or defend a right based on the legitimate interest of the data controller.

other information

the provision of data is mandatory and in the event of refusal to provide it, it will not be possible to purchase the requested products.

purchase with quick checkout

_ purpose

the main purpose of data processing is to allow the user to purchase and receive the purchased product. the data is also necessary for the fulfilment of legal obligations (including those of an accounting and tax nature).

finally, it could be used in the event of disputes raised about the correct fulfilment of the contract.

legal basis

execution of a contract and consequent fulfilment of the legal obligations incumbent on the data controller.

in the event of a dispute, the data will be processed in order to take legal action or defend oneself in court, and this corresponds to the legitimate interest of the data controller.

retention periods

the data will be deleted 10 years after the fulfilment of the contract.

it may be kept for longer only in the event of disputes and therefore to exercise or defend a right based on the legitimate interest of the data controller.

source and categories of data processed

in the case of purchase through quick checkout, personal, shipping, billing and contact data will be imported from paypal. (article 14 gdpr)

_ profiling

purpose

the purpose of the data processing is to send the user newsletters and dem in line with their preferences.

legal basis

consent given by the data subject

retention period

one year from the last sending or until consent is withdrawn.

other information

consent may be withdrawn at any time. the user is completely free to provide the requested data, as there is no legal obligation to do so. however, if the user chooses not to provide the data indicated as essential, the data controller will not be able to fulfil the stated purpose.

_ transactional emails

purpose

transactional emails are intended to enable, manage or complete a contractual or pre-contractual relationship with the user.

by way of example: order confirmation, payment receipt, password reset, shipping updates, technical service communications, account security, basket/purchase management or customer support.

legal basis

contractual performance and fulfilment under

obligations.

retention periods

until the order is delivered or registration is completed.

other information

transactional emails are sent to allow better order management and to provide the customer with confirmation in relation to purchase, shipping and registration.

_ marketing and profiling through digital platforms

purpose

the purpose of the data processing is to show marketing content based on your interests, as identified by your interactions on our website or social media. this includes the use of retargeting tools on digital platforms to deliver targeted advertising messages.

legal basis

consent that can be obtained through various methods:

_ through cookies on our website: your consent to marketing and profiling cookies is collected through the cookie settings on our website.

_ for custom audience crm campaigns (prospecting and retargeting): for these campaigns, we obtain your explicit consent to use your contact details (e.g. email address) for marketing purposes.

interaction with social media pages: if you have given your consent to the use of profiling cookies on our website, we may process your contact details and the information communicated during interaction with social media pages. we use this information, in accordance with your social media privacy settings, to display personalised marketing ads.

retention periods

the data will be retained until consent is withdrawn through the cookie settings.

other information

_ consent obtainedthrough cookies on our site: the user may manage or withdraw this consent at any time, as described in our cookie policy. we also inform you that cookies can be either first-party or third-party and therefore installed, through us, directly by meta.

_ abandoned basket

purpose

the purpose of the data processing is to be able to send 1 email inviting the user to finalise the purchase interrupted on the site.

legal basis

legitimate interest of the data controller in the completion of the purchase.

retention time

72 hours.

other information

the provision of data is automatic and follows the partial completion of the shopping cart.

_ book an appointment at the boutique

purpose

the purpose is to contact the chosen boutique to book an appointment.

legal basis

execution of pre-contractual measures carried out at the request of the data subject.

retention periods

we will process the data for the time necessary to respond to requests and then delete the data.

the data is checked for obsolescence every 12 months.

other information

the user is completely free to provide the requested data, as there is no legal obligation to do so. however, if the user chooses not to provide the data indicated as essential, the data controller will not be able to fulfil the stated purpose.

once collected, the data will be communicated to the chosen boutique for the fulfilment of the purpose.

_ work with us

purpose

the purpose is to allow the data subject to send their cv.

legal basis

execution of pre-contractual measures carried out at the request of the data subject.

retention periods

we will process the data for 2 years, after which it will be deleted.

other information

_ contact us

purpose

the purpose is to contact the data controller.

legal basis

execution of pre-contractual measures carried out at the request of the data subject or execution of the contract (for example, in the case of a return).

retention periods

we will process the data for the time necessary to respond to requests and then delete the data.

the data is checked for obsolescence every 12 months.

other information

_ back in stock

purpose

the purpose is to be contacted by the data controller if a product that is temporarily unavailable becomes available for purchase again.

legal basis

execution of pre-contractual measures carried out at the request of the data subject.

retention periods

the data will be processed until the product becomes available again or in any case for up to 12 months.

other information

_ track the shipment

purpose

the purpose is to allow the user to track the shipment relating to a purchase; to exercise or defend a right in litigation.

legal basis

contractual fulfilment.

in the event of a dispute, the legal basis is found in the legitimate interest of the data controller.

retention periods

we will process the data for as long as necessary to respond to requests and then delete the data.

the data is checked for obsolescence every 12 months.

other information

_ chat

purpose

the purpose is to start a conversation in the chat.

legal basis

consent given by the data subject.

retention periods

the data will be kept until the conversation is closed.

other information

_ browsing data

purpose

site security

legal basis

we will process the data based on the company's legitimate interest in it security and the fulfilment of legal obligations. the legal basis for the processing of cookies other than those that are necessary is consent

retention periods

24 months

other information

for the rules on cookies, please refer to the specific privacy notice.

3. what else do i need to know?

the data will be processed lawfully, fairly and with the utmost confidentiality, in compliance with the appropriate security measures as required by the code and the regulation. the processing will be carried out by digital means. the data will not be publicly disclosed. furthermore, the user will not be subjected to automated decision-making processing such as profiling unless they consent to this through the installation of cookies or other tracking tools, for the regulation of which reference is made to the specific privacy notice.

4. to whom will my data be disclosed?

the data controller may disclose the data to all parties to whom disclosure is legally required by law for the fulfilment of the purposes provided for by law or when such disclosure is necessary to achieve the stated purpose.

the data controller also makes use of certain companies or it tools that carry out processing activities on the personal data of data subjects in the exclusive interest of the data controller, all of which are duly appointed as data processors pursuant to article 28 of the gdpr.

the data will also be disclosed to payment gateways as independent data controllers.

the list of data processors is available on the premises.

the company makes use of designated persons as system administrators, who are in charge of the management and maintenance of the it systems. the updated list of system administrators is available at the data controller's office and can be consulted at the request of the data subject.

5. where is the data stored and transferred?

the management and storage of personal data shall take place on servers located inside and outside the eu. the data controller guarantees that the transfer outside the eu takes place in accordance with articles 44-47 chapter v of the gdpr by signing standard contractual clauses and/or through the eu commission's adequacy decisions.

6. what are my rights and how can i exercise them?

a) rights of the data subject

the user, in their capacity as data subject, has the rights referred to in article 15 et seq. of the regulation, namely:

_ right of access (article 15 gdpr)

the data subject has the right to obtain confirmation as to whether or not personal data concerning them exists, even if it has not yet been recorded, and to have it communicated in an intelligible form.

_ right to rectification (article 16 gdpr)

the data subject has the right to obtain the rectification of inaccurate personal data concerning them and also the completion of incomplete data.

_ right to erasure (article 17 gdpr)

the data subject has the right to obtain the erasure of personal data in the presence of particular reasons such as the withdrawal of consent, objection to processing or if the data are no longer necessary in relation to the purposes for which they were collected and processed or in the event of unlawful processing. it will not always be possible to proceed with erasure, but it will certainly be the responsibility of the data controller to provide adequate justification.

_ right to restriction of processing (article 18 gdpr)

the data subject has the right to obtain the restriction of processing in the event of special circumstances such as, for example, in the case of a request for rectification or an objection during the time taken to assess the requests.

_ right to portability (article 20 gdpr)

if the processing is based on consent or on a contract and is carried out by automated means, the data subject may receive the data in a structured, commonly used and machine-readable format or request that it be transmitted to another data controller.

_ right to object (article 21 gdpr)

the data subject has the right to object, in whole or in part:

a) on legitimate grounds, to the processing of personal data concerning them, even though they are relevant to the purpose of the collection;

b) to the processing of personal data concerning them for the pursuit of purposes not covered by article 2.

the user can make a request to object to the processing of their personal data pursuant to article 21 of the gdpr, in which they must highlight the reasons justifying the objection: the data controller reserves the right to evaluate the request, which would not be accepted if there are compelling legitimate grounds for processing that override the interests, rights and freedoms of the user.

_ right to lodge a complaint

the data subject has the right to lodge a complaint with the competent supervisory authority pursuant to article 77 of the gdpr if they consider that the processing of their data is contrary to the legislation in force.

b) methods of exercise:

the data subject may at any time exercise the rights referred to in the preceding article by contacting the data controller at the addresses indicated above.

latest version: 05/29/2026

this policy has been prepared by polimeni.legal