Privacy Policy – GDPR Supplement

Last updated: 8 September 2026

This GDPR Supplement forms an integral part of, and should be read together with, our Privacy Policy. It provides additional information about the legal bases relied on by ELFRAN SRL when processing personal data under Regulation (EU) 2016/679 (GDPR), in particular for individuals in the European Economic Area.

1. Data controller

ELFRAN SRL
Via di Grotta Perfetta 137
00142 Rome (RM), Italy
VAT / Tax Code No. 11563141008
Email: customercare@degliubertistore.com
Telephone: +39 06 86661304

2. Legal bases for processing

Depending on why personal data is processed, ELFRAN SRL relies on one or more of the legal bases described below.

Performance of a contract or steps taken at your request before entering into a contract — Article 6(1)(b) GDPR

This basis can apply when processing is necessary to provide the online store and services you request, including:

• creating and managing a customer account when requested;
• processing and managing orders;
• processing payments and payment-related information through the relevant payment providers;
• arranging delivery, collection, returns, refunds and customer-service requests connected with a purchase;
• communicating with you about an order, transaction or service you requested.

Compliance with a legal obligation — Article 6(1)(c) GDPR

This basis can apply where processing is necessary to comply with obligations imposed on ELFRAN SRL, including accounting, tax, consumer-protection and other applicable legal or regulatory requirements, retaining records where required by law, and responding to valid requests from public authorities.

Legitimate interests — Article 6(1)(f) GDPR

Where permitted by applicable law, processing can be based on our legitimate interests or those of a third party, including:

• protecting the website, customers and business against fraud, abuse, security incidents and unauthorized activity;
• providing customer support and responding to general enquiries;
• maintaining, troubleshooting and improving the website, services and business operations;
• performing proportionate operational reporting and analytics where consent is not required by applicable law;
• establishing, exercising or defending legal claims and protecting our legal rights.

When we rely on legitimate interests, we consider whether those interests are proportionate and whether your rights and freedoms require greater protection. You may have the right to object to processing based on legitimate interests as described below.

Consent — Article 6(1)(a) GDPR

Where consent is required by law, we rely on your consent for optional processing such as:

• optional analytics, personalization and marketing technologies;
• personalized advertising and related measurement where consent is required;
• email, SMS or other promotional communications where consent is required;
• other optional processing for which you are specifically asked to provide consent.

You can withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn. Cookie-related choices can be changed through Cookie Preferences.

3. Shopify and Network Intelligence

Our online store is hosted by Shopify. Shopify provides the ecommerce infrastructure used for functions such as hosting, checkout, security, fraud prevention, customer accounts, privacy controls and other store services.

Depending on the Shopify service and configuration, Shopify can process personal data as a service provider or processor on our behalf and, for certain services including Enhanced Services associated with Shopify Network Intelligence, can process personal data under its own responsibilities as described in Shopify's privacy documentation.

Where consent is required, optional browser-side technologies and uses such as personalized advertising are managed according to your privacy choices. More information is available in the Shopify Consumer Privacy Policy and through the Shopify Privacy Portal.

4. Marketing communications

Service and transactional communications that are necessary to manage an order or provide a requested service are processed on the legal bases applicable to that transaction. Promotional communications are sent only where there is an appropriate legal basis under applicable data-protection and electronic-communications law. Where consent is required, you can withdraw it at any time. Marketing messages also include the available unsubscribe or opt-out mechanism where required.

5. Retention

Personal data is retained only for as long as reasonably necessary for the purposes described in our Privacy Policy and this Supplement, including to perform contracts, comply with legal, accounting and tax obligations, resolve disputes, establish or defend legal claims, maintain security and honour privacy choices. Retention periods can vary depending on the type of data, the purpose of processing and applicable legal requirements.

Where processing is based on consent, withdrawal of consent will stop the relevant future consent-based processing, subject to any separate lawful retention requirement. Where processing is based on legitimate interests, an objection will be assessed in accordance with the GDPR.

6. Your GDPR rights

Subject to the conditions and limits provided by applicable law, you may have the right to request access to personal data, rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interests. You also have the right to withdraw consent at any time where processing is based on consent.

You have an unconditional right to object at any time to the processing of personal data for direct marketing purposes, including profiling to the extent that it is related to such direct marketing.

You also have the right to lodge a complaint with the competent data-protection supervisory authority. In Italy, the supervisory authority is the Garante per la protezione dei dati personali.

7. How to exercise your rights

To exercise your privacy rights or ask a question about personal-data processing, contact us at customercare@degliubertistore.com. We may need to verify your identity before completing certain requests where permitted or required by law.

Where relevant to data processed by Shopify under its own responsibilities, you can also use the Shopify Privacy Portal.

8. Relationship with our other privacy notices

This Supplement is intended to complement our Privacy Policy. Information about cookies, pixels and similar technologies is provided in our Cookie Policy. If our practices, service providers or applicable requirements change, this Supplement may be updated and the latest version will be published on this page.