This Privacy Policy describes how ORUM & C. SNC, as the data controller, collects, uses, and protects the personal data of users who visit and use the NINFEA website (ninfea.com), make purchases, or contact us.

The protection of our customers' and visitors' personal data is important to us. Data processing is carried out in compliance with Regulation (EU) 2016/679 ("GDPR") and the applicable Italian legislation on personal data protection.

## 1. Data Controller

The data controller of personal data is:

ORUM & C. SNC
Via Ambrogio Soldani 10
52015 Pratovecchio Stia (AR), Italy
VAT/Tax ID: IT01357200516
Commercial Brand: NINFEA
Email: info@ninfea.com

For any request regarding the processing of personal data or the exercise of rights under the GDPR, you can contact us at the address provided above.

## 2. What personal data we collect

Depending on your use of the website, we may collect the following categories of personal data:

- name and surname;
- email address;
- phone number, if provided;
- billing and shipping address;
- information related to orders and purchases made;
- information necessary for managing payments, refunds, and returns;
- communications sent to our customer service;
- preferences regarding commercial communications;
- IP address;
- information related to the device, browser, and operating system used;
- information related to website usage and navigation;
- data collected through cookies and similar technologies, within the limits permitted by applicable law.

We do not directly store full payment card details when payment is managed through external payment service providers.

## 3. Why we use personal data

We process personal data for the following purposes.

### Order management and contractual relationship

We use the necessary data to:

- receive and manage orders;
- process payments;
- prepare and ship products;
- provide information on order status;
- manage returns, refunds, complaints, and after-sales assistance;
- fulfill obligations arising from the sales contract.

The legal basis for processing is the performance of a contract or pre-contractual measures requested by the data subject, pursuant to Art. 6, par. 1, letter b) GDPR.

### Administrative, tax and legal obligations

We may process and store the necessary data to comply with obligations under tax, accounting, administrative regulations and other applicable legal provisions.

The legal basis is the fulfillment of a legal obligation pursuant to Art. 6, par. 1, letter c) GDPR.

### Customer support

When you contact us, we use the data you provide to respond to your requests, provide assistance, and manage any issues related to our products or your orders.

The legal basis may be the performance of the contract, the adoption of pre-contractual measures, or our legitimate interest in providing customer assistance, depending on the nature of the request.

### Security and fraud prevention

We may use certain information to protect the site, customers, and our business from fraud, abuse, unauthorized access, disclosure, alteration, or destruction, and other unlawful activities.

The legal basis is our legitimate interest in the security of the website and the protection of the business, pursuant to Art. 6, par. 1, letter f) GDPR.

### Newsletter and commercial communications

If you have given your consent, we may use your email address and other relevant data to send you newsletters, information about NINFEA products, news, promotions, and other commercial communications.

The legal basis is consent pursuant to Art. 6, par. 1, letter a) GDPR.

You can withdraw your consent at any time by using the unsubscribe link in the communications or by contacting us.

The withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.

## 4. Shopify

The NINFEA website uses the Shopify e-commerce platform.

Shopify provides the technological infrastructure through which our online store is managed and may process personal data necessary for the operation of the site, order management, security, and the provision of its services.

For more information on how Shopify processes personal data, please consult Shopify's privacy policy.

## 5. Payments

Payments made on the website may be managed through external payment service providers.

When you use one of these services, certain data necessary for processing the transaction is communicated directly to the respective provider, who processes it according to their own terms and privacy policies.

ORUM & C. SNC does not directly store full credit card details or other payment instruments when these are processed by payment providers.

Shopify Payments, PayPal, Klarna, etc.

## 6. Cookies and similar technologies

The site uses cookies and similar technologies to enable the proper functioning of the online store and, where consent is required, for statistical, analytical, and marketing purposes.

Cookies strictly necessary for the operation of the site may be used without consent when permitted by law.

Non-strictly necessary cookies and tools are used according to the preferences expressed by the user through the consent management system on the site.

For more information on the categories of cookies used, their purposes, providers, and retention periods, please refer to the Cookie Policy and the cookie preference management panel available on the site.

## 7. With whom we may share data

Personal data may be communicated, to the extent necessary, to entities that help us manage the store and provide the requested services, including:

- e-commerce platform and IT service providers;
- hosting and technological infrastructure service providers;
- payment service providers;
- couriers and logistics operators;
- tax, accounting, and professional consultants;
- customer service providers;
- email and newsletter service providers;
- providers of statistical, advertising, or marketing tools, exclusively when permitted by law and, where necessary, with the user's prior consent;
- public authorities and other entities when communication is required by law.

Entities that process data on our behalf are appointed as data processors when required by Art. 28 GDPR.

## 8. Data transfers outside the European Economic Area

Some of our service providers may process personal data in countries located outside the European Economic Area.

When this occurs, we adopt or rely on the safeguards provided for by applicable law, such as adequacy decisions of the European Commission, standard contractual clauses, or other mechanisms recognized by Articles 44 et seq. of the GDPR.

For more information on transfers made by specific providers, please consult their respective privacy policies.

## 9. How long we retain data

We retain personal data only for the time necessary for the purposes for which it was collected and to comply with legal obligations.

In particular:

- data related to orders, invoicing, and administrative and tax documentation are retained for the periods provided by applicable law;
- data necessary for the management of disputes or controversies may be retained for the period necessary to protect our rights;
- data used for marketing communications are processed until consent is withdrawn or until they are no longer necessary for the purposes for which they were collected, without prejudice to any legal retention requirements;
- the duration of cookies varies depending on their type and is indicated in the cookie preference management system or in the relevant Cookie Policy.

At the end of the applicable periods, data is deleted or anonymized, unless further retention is required by law.

## 10. Your rights

In the cases provided for by the GDPR, you have the right to:

- obtain confirmation as to whether or not personal data concerning you exists;
- obtain access to your personal data;
- request the rectification of inaccurate data or the completion of incomplete data;
- request the erasure of data in cases provided for by law;
- request the restriction of processing;
- object to processing in the cases provided for;
- receive the data in a structured, commonly used, and machine-readable format when the conditions for portability are met;
- withdraw consent previously given at any time;
- not be subject to decisions based solely on automated processing when the conditions provided for in Art. 22 GDPR are met.

To exercise these rights, you can contact ORUM & C. SNC at the email address indicated in this Privacy Policy.

## 11. Complaint to the Supervisory Authority

If you believe that the processing of your personal data takes place in violation of applicable law, you have the right to lodge a complaint with the competent supervisory authority.

For data subjects in Italy, the competent authority is the Garante per la protezione dei dati personali (Italian Data Protection Authority).

The right to resort to other forms of protection provided by law remains unaffected.

## 12. Minors

Our products and services are not specifically intended for minors.

We do not knowingly collect personal data from minors in violation of the limits provided by applicable law. If we become aware that we have collected personal data from a minor without a valid legal basis, we will take appropriate measures to delete it.

## 13. Security

We adopt appropriate technical and organizational measures to protect personal data from loss, misuse, unauthorized access, disclosure, alteration, or destruction.

However, no IT system or data transmission can guarantee absolute security.

## 14. Changes to this Privacy Policy

This Privacy Policy may be updated periodically to reflect regulatory, technical, or organizational changes or changes in the services offered through NINFEA.

The updated version will be published on this page with the indication of the date of the last update.

---

Data Controller
ORUM & C. SNC
Brand: NINFEA
Via Ambrogio Soldani 10
52015 Pratovecchio Stia (AR), Italy
VAT / Tax ID: IT01357200516
Email: info@ninfea.com