Legal information
Privacy Policy
Bluefields Sas di Mingozzi Maria & C., with registered office at Via Carlo Jussi 30 40068 San Lazzaro di Savena (Bo) - Italy , CF/P. IVA IT01517411201 , REA: BO – 340300, the operator of the website available at the URL bluefields.it, as well as any additional domains, subdomains, or addresses associated with the same online store www.bluefields.it (hereinafter, the “Site”), informs users and customers (hereinafter, the “Users” or “Data Subjects”) that personal data relating to browsing the Site, creating and managing an account, purchases, payments, returns and refunds, support requests, and use of additional services will be processed in compliance with Regulation (EU) 2016/679 (“GDPR”), Legislative Decree 196/2003, as amended, and applicable legislation on the protection of personal data. This notice is provided pursuant to Articles 13 and 14 of the GDPR and does not apply to third-party websites or services that may be accessed through links, integrations, or connections on the Site, which are governed by their respective privacy notices.
1. DATA CONTROLLER
The data controller is Bluefields Sas di Mingozzi Maria & C., with registered office at Via Carlo Jussi 30 40068 San Lazzaro di Savena (Bo) - Italy , CF/P. IVA IT01517411201 , REA: BO – 340300, (hereinafter, the “Controller”). For matters relating to the protection of personal data and the exercise of rights under the GDPR, the Controller may be contacted at the email address support@bluefields.it.
2. PURPOSES AND LEGAL BASES FOR DATA PROCESSING
a) Enabling proper navigation and operation of the Site. Technical and navigation data necessary for the operation of the Site, session management, cart, checkout, security, and strictly necessary preferences are processed for the performance of the services requested by the User pursuant to Art. 6(1)(b) GDPR and, where applicable, on the basis of the Controller’s legitimate interest in ensuring the security, integrity, and proper operation of the Site pursuant to Art. 6(1)(f) GDPR.
b) Enabling the use of customer account functionalities. The Website may provide Users with customer account functionalities supplied and technically managed through the Shopify platform, allowing them, among other things, to authenticate, view their order history, manage profile information and addresses, check order status and access any available return functionalities or other reserved services. Bluefields Sas di Mingozzi Maria & C. processes personal data connected with the use of the customer account to make these functionalities available and manage its relationship with the User, pursuant to Article 6(1)(b) of the GDPR. Technical management of the account and its authentication systems is carried out through Shopify, as specified in the section dedicated to recipients and platform providers. Providing the necessary data is a requirement for using the relevant functionalities.
c) Managing the purchase procedure and performing sales contracts. Identification, contact, billing and shipping data, data relating to orders, products, returns, the right of withdrawal, refunds, the legal guarantee and related communications are processed to take pre-contractual measures at the request of the Data Subject and to conclude and perform the contract pursuant to Article 6(1)(b) of the GDPR, as well as to comply with legal obligations related to the sale pursuant to Article 6(1)(c) of the GDPR.
d) Managing payments, receipts, refunds and related checks. Transaction data is processed to receive and reconcile payments, arrange refunds, manage disputes, chargebacks, fraud prevention checks and any further activity necessary to complete the purchase or return. The legal basis is Article 6(1)(b) of the GDPR and, for regulatory and accounting obligations, Article 6(1)(c) of the GDPR; fraud prevention and management activities may also be based on the Controller’s legitimate interest in transaction security pursuant to Article 6(1)(f) of the GDPR. Complete payment instrument details, such as the full card number and related security codes, are collected and processed by payment service providers in accordance with their respective systems and are not stored directly by the Controller.
e) Handle requests, support, and customer service. Data provided by email, telephone, contact forms, messaging, or other support channels are processed to respond to the User’s requests and manage pre-contractual, contractual, and after-sales activities. The legal basis is Art. 6(1)(b) GDPR when the request concerns a contractual or pre-contractual relationship and, in other cases, the Data Controller’s legitimate interest in responding to received requests pursuant to Art. 6(1)(f) GDPR.
f) Prevent abuse, fraud, and unlawful use of the Site and transactions. The Data Controller may process data relating to browsing, the account, orders, and transactions to identify anomalies, attempted fraud, unauthorized use of payment instruments, unauthorized access, or violations of the applicable terms. Processing is based on the Data Controller’s legitimate interest in the security of the Site, transactions, and its assets pursuant to Art. 6(1)(f) GDPR and, where applicable, compliance with legal obligations pursuant to Art. 6(1)(c) GDPR.
g) Send newsletters and commercial communications. The email address and any additional data used to send newsletters, promotional communications, and commercial initiatives are processed on the basis of the Data Subject’s consent pursuant to Art. 6(1)(a) GDPR, except in cases where the law permits communications relating to similar products or services without renewed consent. Consent is optional and may be withdrawn at any time via the link included in the communications or by contacting the Data Controller.
h) Conduct statistical analyses, measurement, and marketing activities by means of cookies or similar technologies. Processing carried out using cookies and other technologies that are not strictly necessary, including non-anonymized analytics tools, campaign measurement, personalization, and advertising, is carried out with the User’s consent pursuant to Art. 6(1)(a) GDPR, where such consent is required. Detailed information, retention periods, and the methods for managing preferences are described in the Site’s Cookie Policy.
i) Comply with legal, tax, accounting, and administrative obligations. The data are processed to comply with obligations under applicable legislation, including provisions on tax, accounting, consumer protection, product safety, and cooperation with the authorities. The legal basis is Article 6(1)(c) of the GDPR.
j) Establish, exercise, or defend rights. The data may be processed to manage complaints, disputes, and controversies, recover debts, protect the rights of the Data Controller, or defend against claims by third parties, on the basis of the Data Controller’s legitimate interest pursuant to Article 6(1)(f) of the GDPR.
3. TYPES AND SOURCES OF THE DATA PROCESSED
The Site is not intended for purchases by persons under 18 years of age. The Data Controller does not intend to knowingly collect the personal data of minors to enable them to make purchases on the Site.
3.1. Browsing and technical data
During normal browsing, IP addresses, device and session identifiers, browser and operating system data, connection information, URLs and pages visited, the date and time of requests, technical events, security logs, and other data generated through interaction with the Site may be processed. Such data may be processed by the Data Controller, Shopify, and the other technical providers involved to provide the service, ensure security and functionality, prevent abuse, and, where permitted, produce usage statistics.
3.2. Cookies and similar technologies
The Site uses cookies, pixels, tags, local storage, and similar technologies. Strictly necessary cookies are used for the operation of the Site and its related functionalities; preference, analytics, and marketing technologies are used within the limits and according to the choices expressed by the User through the consent management system. For detailed information on the individual tools, providers, purposes, durations, and methods for withdrawing or modifying consent, please refer to the Cookie Policy available on the Site.
3.3. Data of the’account, of the’order and contractual relationship
The name and surname, email address, telephone number, credentials and information necessary to manage the account, shipping and billing addresses, any tax code or other tax data, products purchased or returned, amounts, discounts, shipping and delivery methods, order status, and information relating to withdrawal, returns, exchanges, refunds, warranty and after-sales assistance may be processed.
3.4. Data relating to payments and refunds
The Data Controller may receive information relating to the transaction, such as the payment method used, amount, currency, authorization or payment status, transaction identifiers, partially masked payment instrument data, and information necessary for refunds, disputes or reconciliations. Complete card details and confidential payment credentials are processed by payment service providers in accordance with their respective notices and terms.
3.5. Data relating to third parties
The User may provide data concerning a third party, for example when specifying a different recipient for delivery or purchasing a gift. Such data are processed exclusively to the extent necessary to fulfill the order and carry out the related activities. The User is invited to communicate third-party data only when authorized to do so. The Data Controller will provide the third party with the information required by Article 14 of the GDPR in the cases and within the time limits established by applicable law.
3.6. Data from sources other than the’Data subject
Some data may be received from Shopify, Sugo S.n.c., payment service providers, banks, wallets, payment networks, couriers, carriers, anti-fraud services, applications integrated into the Website or other providers involved in fulfilling the order and providing the requested services, limited to the information necessary for the purposes described in this notice.
4. METHODS DATA PROCESSING
Processing is carried out using electronic, telematic and, where necessary, paper-based tools, through operations involving collection, recording, organization, structuring, storage, consultation, processing, use, disclosure, comparison, restriction, erasure and destruction, in accordance with the principles of lawfulness, fairness, transparency, data minimization and security, and with the adoption of appropriate technical and organizational measures pursuant to Article 32 of the GDPR.
The Data Controller may use automated security and anti-fraud systems to identify unusual transactions or behavior and to subject certain operations to further checks. As a rule, the Data Controller does not make decisions based solely on automated processing that produce legal effects or similarly significantly affect the Data Subject. Payment service providers and other third parties may, however, independently perform automated checks in accordance with their own privacy notices and terms, for example to authorize or decline a transaction.
5. DATA RETENTION
Personal data are retained for the time necessary to pursue the purposes for which they are processed and, subsequently, for the periods required by applicable legislation or necessary to protect the rights of the Data Controller. In particular:
– data relating to orders, contracts, payments, refunds, and the related administrative and accounting formalities are retained for the period necessary to perform the relationship and, where required by civil, tax, or accounting legislation, for up to ten years, without prejudice to any longer periods necessary in the event of claims or disputes;
– account-related data are retained until the account is deleted, without prejudice to the separate retention of data that must be kept to comply with legal obligations, execute orders, prevent abuse, or protect rights;
– data relating to requests for assistance are retained for the time necessary to manage the request and, if connected to an order or dispute, for the period applicable to the relevant relationship;
– data processed for newsletter and marketing purposes are retained until consent is withdrawn or the Data Subject objects, except for the minimum retention necessary to document the choices expressed;
– data collected through cookies and similar technologies are retained for the periods indicated in the Cookie Policy and in the consent settings;
– data processed to comply with legal obligations are retained for the period required by the relevant legislation;
– data processed to establish, exercise, or defend a right are retained for the time necessary to manage the relevant claim and, in any event, until the applicable limitation periods expire or any proceedings instituted have been concluded.
6. DISCLOSURE OF DATA AND PARTIES INVOLVED IN PROCESSING
Personal data may be disclosed or made accessible, within the limits necessary for the purposes indicated above, to the parties described below.
6.1. Sugo S.n.c. of Federico Sacchi and Cristian Antolini
The Controller engages Sugo S.n.c. di Federico Sacchi e Cristian Antolini, with registered office in Crevalcore (BO), via Giacomo Matteotti 154, Tax Code and VAT No. 03269341206, REA BO-505415, (hereinafter also “Sugo”), for activities connected with the operational management of the Site and e-commerce services, including, depending on the assignment entrusted, order management, customer assistance, returns, refunds, technical and administrative support, and management of payment flows. When acting on behalf of Bluefields Sas di Mingozzi Maria & C., in accordance with the latter’s instructions and for purposes determined by the Controller, Sugo acts as a data processor pursuant to Article 28 of the GDPR. Sugo is also appointed to receive and collect, in the name and on behalf of the Controller, amounts relating to purchases made on the Site and, where applicable, to manage the related refund flows. Only where and to the extent that, in relation to specific additional processing activities connected with banking relationships or payment accounts held by Sugo, Sugo is required to process personal data in order to comply with legal obligations directly applicable to it, manage its own relationships with banks or payment service providers, or protect its own rights, independently determining the purposes and essential means of processing, Sugo acts, solely with regard to those activities, as an independent data controller. This possible classification does not extend to activities carried out exclusively on behalf of the Controller.
6.2. Shopify
The Site is created and hosted using the Shopify platform. In providing services to the Controller, Shopify generally processes customers’ personal data as a data processor under the applicable Data Processing Addendum. In relation to certain of its own consumer-facing services or advanced features, including services that may require activation of Shopify Network Intelligence, Shopify may also process certain data as an independent data controller, in accordance with its own terms and privacy notices. Further information on Shopify’s processing of data and the related privacy options is available at https://www.shopify.com/it/legal/privacy and, where applicable, at the address https://privacy.shopify.com.
6.3. Payment providers, banking institutions and other recipients
The data may also be disclosed or made accessible to:
– payment service providers, digital wallets, card networks, issuers, banks and payment institutions, including PayPal, Shopify Payments, Klarna or other entities available from time to time at checkout, which may process data as independent data controllers for the purposes set out in their respective privacy notices;
– couriers, carriers, freight forwarders, logistics operators, and pickup points, to the extent necessary for delivery, pickup, and the management of any returns;
– providers of IT, hosting, security, technical support, customer care, communications, email, analytics, marketing, returns management, and other services integrated into the Site, acting as data processors or, where applicable, as independent controllers;
– accountants, consultants, lawyers, auditors, and other professionals, to the extent necessary to perform their respective assignments;
– judicial, administrative, tax, or public security authorities, or other public entities, when disclosure is provided for or required by law;
– personnel, collaborators, and persons authorized by the Controller, within the limits of their respective duties and instructions.
The updated list of data processors may be requested from the Controller using the contact details provided in this privacy notice.
7. TRANSFER OF DATA TO THIRD COUNTRIES
The use of Shopify and other technology, payment, analytics, marketing, or support providers may involve the processing or transfer of personal data outside the European Economic Area. Shopify International Limited, as the relevant contracting entity for merchants in the EMEA region, may use group companies and sub-processors established in different countries; Shopify also states that it currently stores some European merchant and customer data “at rest” in Europe, while continuing to carry out international transfers necessary to provide its services.
When data is transferred to countries that do not benefit from an adequacy decision by the European Commission, the transfer is carried out using appropriate safeguards pursuant to Articles 44 et seq. of the GDPR, including, as applicable, Binding Corporate Rules, standard contractual clauses approved by the European Commission, and any additional measures required by applicable law. For transfers carried out by Shopify, reference is also made to its Data Processing Addendum and the information on international transfers published by Shopify. Any other providers involved apply the transfer mechanisms indicated in their respective privacy notices and terms.
8. DATA SUBJECT RIGHTS
In the cases and within the limits provided for by the GDPR, the Data Subject may exercise the following rights against the Data Controller:
– obtain confirmation as to whether processing is taking place and access their personal data and the information provided for by Article 15 GDPR;
– obtain rectification of inaccurate data and completion of incomplete data pursuant to Article 16 GDPR;
– obtain the erasure of personal data in the cases provided for by Article 17 GDPR;
– obtain restriction of processing in the cases provided for by Article 18 GDPR;
– receive, in the cases provided for by Article 20 GDPR, the data provided to the Data Controller in a structured, commonly used, and machine-readable format and transmit it to another controller;
– object, on grounds relating to their particular situation, to processing based on legitimate interest pursuant to Article 21 GDPR and object at any time to processing for direct marketing purposes;
– withdraw consent at any time, without prejudice to the lawfulness of processing carried out before its withdrawal;
– not be subject, in the cases provided for by Article 22 GDPR, to decisions based solely on automated processing that produce legal effects or similarly significantly affect the person;
– lodge a complaint with the competent supervisory authority. In Italy, the Italian Data Protection Authority can be contacted through the website www.garanteprivacy.it.
Requests relating to processing carried out by Bluefields Sas di Mingozzi Maria & C. may be sent to the Data Controller at the address support@bluefields.it. For processing carried out by third parties acting as independent data controllers, including Shopify where it acts in that capacity, payment service providers and, solely with regard to any specific activities indicated in section 6.1, Sugo, the Data Subject may exercise their rights directly against the relevant controller in accordance with their respective notices.
9. AMENDMENTS TO PRIVACY NOTICE
The Data Controller reserves the right to amend or update this Privacy Policy to reflect changes in legislation, organization, technology, or the services used. The updated version will be published on the Website, indicating the date of the latest update. In the event of substantial changes requiring specific notice to Data Subjects, the Data Controller will adopt the information measures required by applicable law.