Cookie Policy

Cookie Policy and other tracking tools

Data Controller

The Data Controller of the personal data collected through the site is:

Cookies are small text files that visited websites send and store on the user's device, which can be read during subsequent visits.

Cookies can be used, for example, to keep a session active, save the contents of a shopping cart, remember certain preferences, ensure site security, perform statistical analyses, or, subject to consent where required, measure advertising campaigns and personalize marketing activities.

Similar functions can be performed by other technologies, such as pixels, tags, SDKs, local storage, and other identifiers. In this policy, unless otherwise indicated, the term "cookie" also includes similar storage or tracking technologies.

Strictly necessary cookies

These are necessary to enable the operation of the site and the provision of services requested by the user. They may be used, for example, to:

manage the shopping cart and save its contents;
enable access to the customer account;
manage the checkout process and orders;
store necessary settings regarding country, language, or currency;
ensure security, authentication, and fraud prevention;
store user preferences regarding privacy and consent.

Prior user consent is not required for these tools when they are strictly necessary for providing the service.

Preference and functional cookies

These allow the site to remember certain choices made by the user and to provide additional features or more personalized navigation. When such tools are not strictly necessary, they are used according to the preferences expressed by the user.

Analytics cookies

These may be used to understand how users interact with the site, measure visits, pages viewed, traffic sources, performance, and use of features.

Analytics tools are managed in compliance with applicable law. When conditions allowing them to be equated to technical cookies are not met, they are activated only after obtaining the user's consent.

Marketing and profiling cookies

These may be used to measure the effectiveness of advertising campaigns, attribute conversions, create audience segments, personalize advertising content, and perform remarketing activities.

Such tools, when they require consent under applicable law, are not activated until the user has expressed their choice.

The site is created using the Shopify ecommerce platform. Shopify may use cookies and similar technologies necessary for the operation of the store and, depending on store settings and user-expressed preferences, tools for analytics and marketing.

The main cookies that may be used on Shopify storefronts include the following:

Cookie	Category / function	Estimated duration
_shopify_essential	Necessary. Contains essential information for the correct operation of the store, including information regarding session, checkout, and security.	1 year
_shopify_test	Necessary. Verifies if cookies can be used on the device.	1 minute
_tracking_consent	Necessary for managing user privacy preferences in areas where consent-related rules are configured.	1 year
cart	Necessary. Contains information regarding the user's cart.	2 weeks
cart_currency	Necessary. Allows initializing a new cart using the currency used in the previous checkout.	2 weeks
discount_code	Stores any discount code received through a URL parameter so it can be used in the subsequent checkout.	Session
localization	Necessary for cart localization in relation to the selected country.	1 year
shopify_pay	Allows access to Shop Pay when the user returns to the checkout of the same store.	1 year
_landing_page	Analytics. Allows detecting the entry page of the user when coming from another site.	2 weeks
_orig_referrer	Analytics. Allows detecting the source of visits.	2 weeks
_shopify_analytics	Contains analytics data regarding Shopify surfaces such as storefronts or checkout.	1 year
_shopify_s	Analytics. Allows identifying a specific combination between browser session and store.	30 minutes
_shopify_y	Used for Shopify's analytics features.	1 year
_shopify_marketing	Marketing. May contain data used for marketing purposes on Shopify surfaces.	1 year

The list may vary over time depending on the Shopify features used, store configuration, and updates made to the platform.

For the updated list and further information on the technologies used by the platform, you can consult Shopify's cookie policy.

Depending on the services actually enabled on the site, technologies provided by third parties may be used for technical features, statistical analysis, content integration, and advertising activities.

The activation of non-essential tools is subject to user consent when required by applicable law.

Provider / service	Possible purpose	Information
Shopify	Ecommerce platform, security, checkout, analytics, and store-related features.	Shopify Privacy Policy
Google	If enabled: statistical analysis, conversion measurement, advertising services, and Google features.	Google Privacy Policy
Meta	If enabled: conversion measurement, advertising, creation of audience segments, and remarketing.	Meta Privacy Policy

The actual presence of individual tools may depend on the features, applications, and campaigns active on the site at any given time.

Legal basis and consent

Cookies and other strictly necessary tools are used to the extent necessary to enable navigation and provide the features and services requested by the user.

For non-essential cookies and tracking tools, where required by applicable law, processing is carried out based on the user's consent.

Upon first access to the site, the user can use the dedicated banner to accept, reject, or manage categories of non-essential cookies. Closing the banner without giving consent maintains settings that do not allow the use of non-essential tools, without prejudice to any tools that can be used without consent under the law.

Any consent given can be modified or revoked at any time through the privacy preference management command available on the site.

Cookies can be session-based, and therefore deleted at the end of the browsing session, or persistent, remaining stored on the device for a specified period.

The duration varies depending on the individual cookie, its purpose, and the entity providing it. The durations indicated by the provider for the main Shopify cookies are listed above. Different periods may apply to third-party tools, as described in their respective policies.

In addition to the preference management system available on the site, the user can configure their browser to block, limit, or delete cookies.

Disabling strictly necessary cookies may prevent or compromise some essential store features, such as the cart, authentication, or checkout.

Instructions for managing cookies are available on the websites of the main browsers:

Deleting cookies from the browser may also involve deleting previously stored consent preferences.

Personal data processing and Privacy Policy

The use of some cookies and tracking tools may involve the processing of personal data, such as online identifiers, device information, browsing data, and information on interactions with the site.

For more information on how OVYÈ S.R.L. processes personal data, the purposes and legal bases of processing, recipients, any data transfers, and data subject rights, please consult the Privacy Policy.

Contacts

For information regarding this Cookie Policy or the processing of personal data, you can contact the Data Controller:

This Cookie Policy may be updated to reflect regulatory, technical, or service-related changes on the site. The last update date is indicated at the beginning of the page.

Last updated: September 7, 2026

OVYÈ S.R.L., with registered office in Via dei Pellicciai, Blocco 1 Centergross, 40050 Funo di Argelato (BO), VAT and Tax Code IT03415721202, REA BO n. 517639, owner of the website accessible at the URL www.ovye.it, as well as any other domains, subdomains or addresses attributable to the same online store (hereinafter, the “Website”), informs users and customers (hereinafter, “Users” or “Data Subjects”) that personal data relating to browsing the Website, account creation and management, purchases, payments, returns and refunds, assistance requests and the use of other services will be processed in compliance with Regulation (EU) 2016/679 (“GDPR”), Legislative Decree 196/2003, as amended, and applicable legislation on personal data protection. This privacy policy is provided pursuant to Articles 13 and 14 of the GDPR and does not apply to third-party websites or services that may be reached via links, integrations or connections on the Website, for which their respective privacy policies apply.

1. DATA CONTROLLER

The data controller is OVYÈ S.R.L., with registered office in Via dei Pellicciai, Blocco 1 Centergross, 40050 Funo di Argelato (BO), VAT and Tax Code IT03415721202, REA BO n. 517639, (hereinafter, the “Controller”). For matters relating to personal data protection and for exercising the rights provided by the GDPR, the Controller can be contacted at the e-mail address support@ovye.it.

2. PURPOSES AND LEGAL BASES FOR DATA PROCESSING

a) To enable proper browsing and functioning of the Website. Technical and browsing data necessary for the functioning of the Website, session management, shopping cart, checkout, security, and strictly necessary preferences are processed for the execution of the services requested by the User pursuant to Article 6, para. 1, letter b), GDPR and, where applicable, based on the legitimate interest of the Controller to ensure the security, integrity, and correct functioning of the Website pursuant to Article 6, para. 1, letter f), GDPR.

b) To enable the use of customer account functionalities. The Website may provide Users with customer account functionalities supplied and technically managed through the Shopify platform, which allow, among other things, authentication, viewing order history, managing profile information and addresses, checking order status, and accessing any return functionalities or other reserved services. OVYÈ S.R.L. processes personal data related to the use of the customer account to make these functionalities available and manage the relationship with the User, pursuant to Article 6, para. 1, letter b), GDPR. The technical management of the account and related authentication systems is carried out through Shopify, as specified in the section dedicated to recipients and platform providers. The provision of necessary data is a requirement for using the related functionalities.

c) To manage the purchase procedure and execute sales contracts. Identification data, contact data, billing and shipping data, data relating to orders, products, returns, right of withdrawal, refunds, legal warranty, and related communications are processed to take pre-contractual measures at the request of the Data Subject and to conclude and execute the contract pursuant to Article 6, para. 1, letter b), GDPR, as well as to comply with legal obligations related to sales pursuant to Article 6, para. 1, letter c), GDPR.

d) To manage payments, collections, refunds, and related verifications. Transaction data is processed to receive and reconcile payments, arrange refunds, manage disputes, chargebacks, anti-fraud checks, and any other activity necessary for the execution of the purchase or return. The legal basis is Article 6, para. 1, letter b), GDPR and, for regulatory and accounting compliance, Article 6, para. 1, letter c), GDPR; fraud prevention and management activities may also be based on the legitimate interest of the Controller in transaction security pursuant to Article 6, para. 1, letter f), GDPR. Full payment instrument data, such as the full card number and related security codes, are acquired and processed by payment service providers according to their respective systems and are not directly stored by the Controller.

e) To manage requests, assistance, and customer service. Data communicated via e-mail, telephone, contact forms, messaging, or other assistance channels are processed to respond to User requests and manage pre-contractual, contractual, and post-sales activities. The legal basis is Article 6, para. 1, letter b), GDPR when the request concerns a contractual or pre-contractual relationship and, in other cases, the legitimate interest of the Controller in responding to received requests pursuant to Article 6, para. 1, letter f), GDPR.

f) To prevent abuse, fraud, and illicit use of the Website and transactions. The Controller may process data related to browsing, accounts, orders, and transactions to detect anomalies, attempted fraud, unauthorized use of payment instruments, abusive access, or violations of applicable conditions. Processing is based on the legitimate interest of the Controller in the security of the Website, transactions, and its assets pursuant to Article 6, para. 1, letter f), GDPR, and, where applicable, on compliance with legal obligations pursuant to Article 6, para. 1, letter c), GDPR.

g) To send newsletters and commercial communications. The e-mail address and any other data used for sending newsletters, promotional communications, and commercial initiatives are processed based on the consent of the Data Subject pursuant to Article 6, para. 1, letter a), GDPR, except in cases where the law allows communications relating to similar products or services without new consent. Consent is optional and can be revoked at any time via the link in the communications or by contacting the Controller.

h) To perform statistical analyses, measurement, and marketing activities using cookies or similar technologies. Processing carried out using cookies and other non-strictly necessary technologies, including non-anonymized analytics tools, campaign measurement, personalization, and advertising, are carried out with the User's prior consent pursuant to Article 6, para. 1, letter a), GDPR, where such consent is required. Detailed information, durations, and methods for managing preferences are described in the Website's Cookie Policy.

i) To comply with legal, tax, accounting, and administrative obligations. Data is processed to comply with obligations set forth by applicable law, including provisions on tax, accounting, consumer protection, product safety, and cooperation with authorities. The legal basis is Article 6, para. 1, letter c), GDPR.

j) To ascertain, exercise, or defend rights. Data may be processed to manage complaints, disputes, and litigation, recover debts, protect the Controller's rights, or defend against third-party claims, based on the legitimate interest of the Controller pursuant to Article 6, para. 1, letter f), GDPR.

3. TYPES AND SOURCES OF DATA PROCESSED

The Website is not intended for purchases by individuals under 18 years of age. The Controller does not intend to knowingly collect personal data of minors to allow them to make purchases on the Website.

3.1. Browsing and technical data

During normal browsing, IP addresses, device and session identifiers, browser and operating system data, connection information, URLs and visited pages, date and time of requests, technical events, security logs, and other data generated by interaction with the Website may be processed. Such data may be processed by the Controller, Shopify, and other technical providers involved to provide the service, ensure security and functionality, prevent abuse, and produce, where permitted, usage statistics.

3.2. Cookies and similar technologies

The Website uses cookies, pixels, tags, local storage, and similar technologies. Strictly necessary cookies are used for the functioning of the Website and its related functionalities; preference, statistical, and marketing technologies are used within the limits and according to the choices expressed by the User through the consent management system. For detailed information on individual tools, providers, purposes, durations, and methods of revoking or changing consent, please refer to the Cookie Policy available on the Website.

3.3. Account, order, and contractual relationship data

First name and surname, e-mail address, telephone number, credentials and information necessary for account management, shipping and billing addresses, any tax code or other tax data, purchased or returned products, amounts, discounts, shipping and delivery methods, order status, information relating to withdrawal, returns, exchanges, refunds, warranty, and after-sales assistance may be processed.

3.4. Payment and refund data

The Controller may receive transaction-related information, such as payment method used, amount, currency, authorization or payment status, transaction identifiers, partially masked payment instrument data, information necessary for refunds, disputes, or reconciliations. Full card data and confidential payment credentials are processed by payment service providers according to their respective policies and terms.

3.5. Third-party data

The User may provide third-party data, for example, when indicating a different recipient for delivery or purchasing a gift. Such data is processed solely to the extent necessary to fulfill the order and related activities. The User is invited to communicate third-party data only when authorized to do so. The Controller will provide the third party with the information required by Article 14 of the GDPR in the cases and times provided by applicable law.

3.6. Data from sources other than the Data Subject

Some data may be received from Shopify, Sugo S.n.c., payment service providers, banks, wallets, payment circuits, couriers, carriers, anti-fraud services, applications integrated into the Website or other providers involved in the execution of the order and requested services, limited to the information necessary for the purposes described in this privacy policy.

4. DATA PROCESSING METHODS

Processing is carried out using electronic, telematic and, where necessary, paper-based tools, through operations of collection, recording, organization, structuring, storage, consultation, processing, use, communication, comparison, limitation, erasure and destruction, in accordance with principles of lawfulness, fairness, transparency, data minimization and security, and with the adoption of appropriate technical and organizational measures pursuant to Article 32 GDPR.

The Controller may use automated security and anti-fraud systems to identify anomalous transactions or behaviors and to subject certain operations to further checks. As a rule, the Controller does not make decisions based solely on automated processing that produce legal effects or similarly significantly affect the Data Subject. However, payment providers and other third parties may independently carry out automated checks according to their own policies and conditions, for example, to authorize or reject a transaction.

5. DATA RETENTION

Personal data is retained for the time necessary to achieve the purposes for which it is processed and, subsequently, for the periods required by applicable law or necessary for the protection of the Controller's rights. In particular:

– data relating to orders, contracts, payments, refunds and related administrative-accounting formalities are retained for the period necessary for the execution of the relationship and, where required by civil, tax or accounting law, up to ten years, without prejudice to further terms necessary in case of disputes or litigation;

– account-related data is retained until the account is deleted, subject to separate retention of data that must be kept for legal obligations, order fulfillment, abuse prevention or rights protection;

– data relating to assistance requests are retained for the time necessary to manage the request and, if connected to an order or a dispute, for the period applicable to the related relationship;

– data processed for newsletter and marketing purposes are retained until the Data Subject's consent is revoked or objection is raised, except for the minimum retention necessary to document the expressed choices;

– data collected through cookies and similar technologies are retained according to the times indicated in the Cookie Policy and consent settings;

– data processed to comply with legal obligations are retained for the period provided by the relevant legislation;

– data processed to ascertain, exercise or defend a right are retained for the time necessary to manage the related claim and, in any case, until the expiry of the applicable statute of limitations or the definition of any initiated proceedings.

6. DATA DISCLOSURE AND PARTIES INVOLVED IN PROCESSING

Personal data may be disclosed or made accessible, to the extent necessary for the purposes indicated above, to the parties described below.

6.1. Sugo S.n.c. di Federico Sacchi e Cristian Antolini

The Controller uses Sugo S.n.c. di Federico Sacchi e Cristian Antolini, with registered office in Crevalcore (BO), via Giacomo Matteotti 154, Tax Code and VAT number 03269341206, (hereinafter, also “Sugo”), for activities related to the operational management of the Website and e-commerce services, including, depending on the assigned task, order management, customer assistance, returns, refunds, technical and administrative support, and payment flow management. When operating on behalf of OVYÈ S.R.L., according to the latter's instructions and for purposes determined by the Controller, Sugo acts as a data processor pursuant to Article 28 GDPR. Sugo is also responsible for receiving and collecting, in the name and on behalf of the Controller, the amounts related to purchases made on the Website and, where applicable, for managing the related refund flows. Only if and to the extent that, in relation to specific further processing connected to bank relationships or payment accounts held by Sugo, the latter is required to process personal data to comply with legal obligations directly incumbent on it, manage its own relationships with banks or payment service providers, or protect its own rights, independently determining the purposes and essential means of processing, Sugo operates as an independent controller limited to these activities. This potential qualification does not extend to activities carried out exclusively on behalf of the Controller.

6.2. Shopify

The Website is built and hosted using the Shopify platform. Within the scope of the services provided to the Controller, Shopify generally processes customers' personal data as a data processor according to the applicable Data Processing Addendum. In relation to certain proprietary services aimed at consumers or advanced functionalities, including services that may require the activation of Shopify Network Intelligence, Shopify may also process certain data as an independent controller, according to its own terms and policies. More information on Shopify's data processing and related privacy options is available at https://www.shopify.com/it/legal/privacy and, where applicable, at https://privacy.shopify.com.

6.3. Payment providers, banks, and other recipients

Data may also be disclosed or made accessible to:

– payment service providers, digital wallets, card schemes, issuers, banks, and payment institutions, including PayPal, Shopify Payments, Klarna, or other entities available from time to time at checkout, who may process data as independent controllers for the purposes determined in their respective policies;

– couriers, carriers, freight forwarders, logistics operators, and pick-up points, to the extent necessary for delivery, collection, and management of any returns;

– IT, hosting, security, technical assistance, customer care, communications, email, analytics, marketing, returns management, and other application providers integrated into the Website, who act as data processors or, when the conditions are met, as independent controllers;

– accountants, consultants, lawyers, auditors, and other professionals, to the extent necessary for the performance of their respective duties;

– judicial, administrative, tax, public security authorities, or other public entities, when disclosure is required or mandated by law;

– personnel, collaborators and subjects authorised by the Controller, within the limits of their respective duties and instructions.

The updated list of data processors can be requested from the Controller at the addresses indicated in this policy.

7. TRANSFER OF DATA TO THIRD COUNTRIES

The use of Shopify and other technological, payment, analytics, marketing, or support providers may involve the processing or transfer of personal data outside the European Economic Area. Shopify International Limited, as the contractual entity of reference for merchants in the EMEA area, may use group companies and sub-processors established in different countries; Shopify also declares that it currently stores some data of European merchants and customers "at rest" in Europe, while continuing to carry out international transfers necessary for the provision of its services.

When data is transferred to countries that do not benefit from an adequacy decision by the European Commission, the transfer is carried out using appropriate safeguards in accordance with Articles 44 et seq. of the GDPR, such as, depending on the case, binding corporate rules (Binding Corporate Rules), standard contractual clauses approved by the European Commission and additional measures required by applicable law. For transfers carried out by Shopify, reference is also made to the relevant Data Processing Addendum and the information on international transfers published by Shopify. The other providers potentially involved apply the transfer mechanisms indicated in their respective policies and conditions.

8. DATA SUBJECT RIGHTS

In the cases and within the limits provided for by the GDPR, the Data Subject may exercise the following rights towards the Controller:

– obtain confirmation of the existence of processing and access to their personal data and the information provided for by Art. 15 GDPR;

– obtain the rectification of inaccurate data and the integration of incomplete data pursuant to Art. 16 GDPR;

– obtain the erasure of personal data in the cases provided for by Art. 17 GDPR;

– obtain the restriction of processing in the cases provided for by Art. 18 GDPR;

– receive, in the cases provided for by Art. 20 GDPR, the data provided to the Controller in a structured, commonly used and machine-readable format and transmit them to another controller;

– object, for reasons related to their particular situation, to processing based on legitimate interest pursuant to Art. 21 GDPR and object at any time to processing for direct marketing purposes;

– withdraw consent given at any time, without prejudice to the lawfulness of the processing carried out before the withdrawal;

– not be subject, in the cases provided for by Art. 22 GDPR, to decisions based solely on automated processing that produce legal effects or similarly significantly affect the person;

– lodge a complaint with the competent supervisory authority. In Italy, the Garante per la protezione dei dati personali can be reached via the website www.garanteprivacy.it.

Requests relating to processing carried out by OVYÈ S.R.L. can be sent to the Controller at support@ovye.it. For processing carried out by third parties as independent controllers, including Shopify in cases where it acts in such capacity, payment service providers and, limited to any specific activities indicated in point 6.1, Sugo, the Data Subject may exercise their rights directly towards the respective controller according to their respective policies.

9. CHANGES TO THE PRIVACY POLICY

The Controller reserves the right to modify or update this Privacy Policy to adapt it to regulatory, organizational, technical or service changes. The updated version will be published on the Website with an indication of the date of the last update. In the event of substantial changes requiring specific communication to Data Subjects, the Controller will adopt the information measures provided for by applicable law.