PRIVACY POLICY
(Information on the processing of personal data pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 — GDPR)
Last updated: 25 August 2026
1. Who we are (Data Controller)
The Data Controller is:
Felfil S.r.l.
Via Sant'Ambrogio 28 — 10139 Turin (TO), Italy
VAT / Tax code 11482100010
Email: privacy@felfil.com — General email: support@felfil.com
Felfil S.r.l. has not appointed a Data Protection Officer (DPO), as the conditions set out in Article 37 GDPR do not apply.
2. What this policy covers
This policy concerns the personal data we process when you:
- browse felfil.com and its other language versions;
- buy from our online store or request a quote;
- create a customer account;
- subscribe to our newsletter;
- contact us for support, information or to become a reseller;
- interact with our social media pages.
The website may contain third-party links or embedded content (e.g. YouTube videos). When you use them, those parties' own privacy policies also apply, and we have no control over them.
3. What data we collect
| Category | Examples |
|---|---|
| Identification and contact data | first and last name, email, phone, company/institution, country |
| Account data | username, password (stored in encrypted form), preferences |
| Purchase and billing data | billing and shipping address, products purchased, amounts, VAT/tax code for invoicing |
| Payment data | we neither see nor store them: they are handled directly by Stripe and PayPal |
| Support data | content of your requests, product serial number, service history |
| Browsing data | IP address, browser and device type, pages visited, referral source, interactions with the site |
| Data collected through cookies and tracking tools | see our Cookie Policy |
We do not knowingly process special categories of data (Article 9 GDPR): please do not send us any.
4. Why we process your data, on what legal basis and for how long
This is the most important part of this policy: for each purpose we state the legal ground that allows us to process the data and how long we keep it.
| Purpose | Legal basis (Art. 6 GDPR) | Retention |
|---|---|---|
| Creating and managing your customer account | Performance of a contract — Art. 6(1)(b) | For as long as the account is active; deleted within 30 days of a closure request |
| Managing orders, payments, shipping, returns and warranty | Performance of a contract — Art. 6(1)(b) | For the duration of the relationship and the warranty period; thereafter within the time limits for defending legal claims |
| Complying with tax, accounting and customs obligations | Legal obligation — Art. 6(1)(c) | 10 years from the recording of the transaction (Art. 2220 of the Italian Civil Code) |
| Providing technical support and answering enquiries | Performance of a contract / legitimate interest in handling requests — Art. 6(1)(b)–(f) | 24 months from closure of the request |
| Sending you our newsletter and commercial communications | Consent — Art. 6(1)(a) | Until consent is withdrawn; we re-verify interest after 24 months of inactivity |
| Sending you emails about products and services similar to those you already purchased ("soft spam") | Legitimate interest, within the limits of Art. 130(4) of the Italian Data Protection Code | Until you object, which is always possible and free of charge |
| Measuring website usage through analytics tools | Consent — Art. 6(1)(a) and Art. 122 of the Italian Data Protection Code | See durations in the Cookie Policy |
| Personalised marketing, remarketing and advertising measurement (profiling) | Consent — Art. 6(1)(a) and Art. 122 of the Italian Data Protection Code | See durations in the Cookie Policy |
| Ensuring website security and preventing fraud and abuse | Legitimate interest — Art. 6(1)(f) | Maximum 12 months for security logs |
| Establishing, exercising or defending legal claims | Legitimate interest — Art. 6(1)(f) | For the duration of the dispute and until the applicable appeal deadlines |
At the end of these periods, data is deleted or irreversibly anonymised.
5. Is providing your data mandatory?
- To purchase or receive support: the fields marked as required in our forms are necessary. Without them we cannot enter into the contract or provide the service.
- For the newsletter and non-necessary cookies: providing data is entirely optional. If you do not consent, you can still browse and purchase normally.
6. Who we share your data with
Your data is accessible to authorised Felfil staff (administration, order management, support), who act under written instructions.
We also share it with suppliers who process data on our behalf, appointed as Data Processors pursuant to Article 28 GDPR:
| Supplier | Service | Location |
|---|---|---|
| SiteGround Spain S.L. | Website hosting | Spain (EU) |
| Google Ireland Ltd. | Google Analytics 4, Google Tag Manager | Ireland (EU), with possible transfers to the USA |
| Hotjar Ltd. | Browsing behaviour analytics | Malta (EU) |
| Brevo (Sendinblue SAS) | Email and newsletter delivery | France (EU) |
| 4Dem S.r.l. | Email and newsletter delivery | Italy (EU) |
| The Rocket Science Group LLC d/b/a Mailchimp (Intuit group) | Email and newsletter delivery | United States |
| CookieYes Limited | Cookie consent collection and management | United Kingdom |
| MailMunch (Cinco Inc.) | Pop-ups and subscription capture forms | United States |
| tawk.to Inc. | On-site support chat | United States |
Other parties process your data as independent controllers or joint controllers: they decide the purposes and means of processing themselves and are directly accountable to you under their own privacy policies.
| Party | Role | Privacy policy |
|---|---|---|
| Meta Platforms Ireland Ltd. | Joint controller (Art. 26 GDPR) for data collected via the Meta Pixel for advertising and measurement | Meta |
| LinkedIn Ireland Unlimited Company | Joint controller (Art. 26 GDPR) for data collected via the LinkedIn Insight Tag for advertising and measurement | |
| Google Ireland Ltd. | Independent controller for Google Ads advertising services | |
| Stripe Payments Europe Ltd. | Independent controller for card payment processing | Stripe |
| PayPal (Europe) S.à r.l. et Cie, S.C.A. | Independent controller for PayPal payments | PayPal |
| Couriers and shipping companies | Independent controllers for order delivery | Policy of the individual carrier |
| Accountants and professional advisers | Independent controllers for statutory obligations | — |
We disclose data to public authorities only where required by law or upon a lawful request from judicial authorities.
We do not sell your personal data to third parties. We may publish aggregated, anonymous statistics that in no way allow an individual to be identified.
In the event of a merger, business transfer or other extraordinary corporate transaction, data may be transferred to the acquiring party, which will be bound by the same commitments set out in this policy; we will notify you in advance.
7. Transfers outside the European Union
Data is stored on servers located within the European Union.
Some suppliers may transfer data outside the European Union. In such cases, the transfer takes place on the basis of one of the safeguards provided for in Chapter V of the GDPR:
- United States (Mailchimp/Intuit and, for certain functions, Google and Meta): the EU-US Data Privacy Framework adequacy decision adopted by the European Commission on 10 July 2023, to which these suppliers have self-certified, supplemented by the Standard Contractual Clauses included in their respective data processing agreements as an additional safeguard.
- United Kingdom (CookieYes): the European Commission adequacy decision, renewed on 19 December 2025 and valid until 27 December 2031.
You can request a copy of the safeguards in place by writing to privacy@felfil.com.
8. How we protect your data
We apply technical and organisational measures appropriate under Article 32 GDPR: encrypted HTTPS connection, restricted and named access, encrypted passwords, regular backups, system updates, and selection of suppliers meeting adequate standards.
No system is 100% secure: in the event of a personal data breach likely to result in a high risk to your rights, we will inform you without undue delay, as required by Article 34 GDPR.
9. Automated decision-making
We do not take decisions based solely on automated processing that produce legal effects concerning you.
If you consent to marketing cookies, your browsing data may be used to show you personalised ads on Google and Meta platforms: this constitutes profiling for advertising purposes, which you can refuse or withdraw at any time with no consequences.
10. Your rights
You may exercise the following rights under Articles 15–22 GDPR at any time, free of charge:
- access — find out what data we hold and receive a copy;
- rectification — correct inaccurate or incomplete data;
- erasure ("right to be forgotten") — in the cases set out in Article 17;
- restriction of processing — Article 18;
- portability — receive your data in a machine-readable format and transfer it to another controller — Article 20;
- objection to processing based on legitimate interest and, in any case and without giving reasons, to direct marketing — Article 21;
- withdrawal of consent at any time, without affecting the lawfulness of processing carried out before withdrawal — Article 7(3).
How to exercise them: write to privacy@felfil.com or to Felfil S.r.l., Via Sant'Ambrogio 28, 10139 Turin, Italy. We will reply within one month, extendable by two further months in complex cases, in which case we will let you know.
You can also handle many things yourself: update your details in the "My account" area, unsubscribe from the newsletter using the link at the bottom of every email, and change your cookie preferences via the "Cookie preferences" link in the website footer.
Complaint to the supervisory authority. If you believe the processing infringes data protection law, you have the right to lodge a complaint with the Italian Data Protection Authority — Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, Italy — protocollo@gpdp.it — www.garanteprivacy.it (Article 77 GDPR), or with the supervisory authority of your country of residence, or to bring proceedings before the courts.
11. Children
Our products and services are not intended for children under 14 years of age, the age set by Article 2-quinquies of the Italian Data Protection Code (Legislative Decree 196/2003, as amended by Legislative Decree 101/2018) for consent to information society services.
We do not knowingly collect data from children under 14. Should we become aware that we have done so, we will delete the data as soon as possible. Parents and legal guardians can report this to us at privacy@felfil.com.
12. Changes to this policy
We may update this policy to reflect legal, technical or organisational developments. The current version is always published on this page, with the last-updated date at the top. If changes are substantial and concern processing based on consent, we will notify you and, where necessary, ask for your consent again.
In the event of any discrepancy between the language versions of this policy, the Italian version prevails for users resident in Italy.