Privacy Policy
PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA
pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and Legislative Decree 196/2003, as amended by Legislative Decree 101/2018 (“Privacy Code”)
Last updated: 13 October 2026
This privacy policy describes how we process the personal data of users who visit the website www.addicted-to.com (the “Website”), purchase products from the online shop or contact us. This privacy policy applies only to this Website and not to any other websites that may be accessed via links.
1. Data controller
The data controller is COSTA CALDURA S.R.L., with its registered office at Via Vincenzo Cavallaro 13 – 90015 Cefalù (PA), Italy – VAT No. IT06497310828.
Email: info@addicted-to.com – Tel.: 339 627 4001.
The Data Controller has not appointed a Data Protection Officer (DPO), as it is not required to do so.
2. What data do we process?
- Browsing data: IP address, browser type and operating system, date and time of the request, pages visited and other technical parameters transmitted automatically whilst using the Website. The IP address is also used to determine, approximately, the country of origin in order to suggest appropriate delivery and language settings.
- Data provided voluntarily: first name, surname, email address, telephone number and the content of messages sent via the contact form or by email.
- Data relating to purchases and customer accounts: first name and surname, billing and delivery addresses, email address, telephone number, tax code or VAT number (if applicable), order details, purchase history, return and cancellation requests, account credentials (the password is stored in encrypted form).
- Payment details: Payment card details are entered and processed directly by the payment service providers (Stripe, PayPal) via an encrypted connection. The Data Controller does not know or store the full card number; it only receives confirmation that payment has been made and limited data (e.g. card type and the last few digits).
- Curriculum Vitae which may have been sent of their own accord.
- Data collected via cookies and similar tools (see point 10).
The Website and the online shop are intended for adults. We do not knowingly process the personal data of anyone under the age of 18.
3. Purposes and legal bases for processing
| Purpose | Legal basis |
|---|---|
| (a) To respond to enquiries and contact requests | The performance of pre-contractual measures or a contract (Article 6(1)(b) of the GDPR) or a legitimate interest in responding to enquiries received (Article 6(1)(f) of the GDPR) |
| b) Management of the customer account, conclusion and performance of the sales contract: order processing, payment, dispatch, customer support, returns, withdrawal and warranty | Performance of the contract (Article 6(1)(b) of the GDPR) |
| (c) Compliance with legal obligations, in particular those relating to tax and accounting | Legal obligation (Article 6(1)(c) of the GDPR) |
| (d) Website security, prevention of payment fraud and spam in forms | Legitimate interest of the Data Controller (Article 6(1)(f) of the GDPR) |
| (e) Establishing, exercising or defending rights in court | Legitimate interest of the Data Controller (Article 6(1)(f) of the GDPR) |
| (f) Statistics on the use of the Website via third-party analytics cookies (Google Analytics) | Consent (Article 6(1)(a) of the GDPR and Article 122 of the Privacy Code), which may be withdrawn at any time |
| (g) Sending promotional communications and newsletters | Consent (Article 6(1)(a) of the GDPR), which may be withdrawn at any time |
| (h) Assessment of unsolicited applications | Pre-contractual measures at the request of the data subject (Article 6(1)(b) of the GDPR) |
No automated decision-making or profiling takes place within the meaning of Article 22 of the GDPR.
4. Nature of the contribution
The provision of data for purposes (a), (b), (c) and (h) is optional, but necessary: without it, it will not be possible to respond to enquiries, conclude and fulfil the purchase contract, or assess the application. Providing data for purposes f) and g) is optional, and failure to give consent has no impact on the use of the Website or on purchases.
5. Methods of processing
Data is processed using electronic means and, where necessary, on paper, in accordance with the principles of lawfulness, fairness, transparency, data minimisation and storage limitation, by adopting appropriate technical and organisational measures to protect it from loss, unlawful use or unauthorised access (including an encrypted HTTPS connection and access restricted to authorised staff).
6. Recipients of the data
The data may be processed by authorised staff of the Data Controller and disclosed, solely for the purposes indicated, to the following categories of parties, who act as data processors (Article 28 of the GDPR) or as independent data controllers:
- the provider of hosting and technical maintenance for the Website, including the web agency that manages it;
- payment service providers: Stripe Payments Europe Ltd. (Ireland), PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) and WooPayments (Automattic Inc.), which act as independent data controllers with regard to payment data;
- couriers and freight forwarders responsible for delivering the products;
- software and anti-spam service providers required for the operation of the shop and its modules (WooCommerce/Akismet – Automattic Inc.);
- Google Ireland Ltd. for the Google Analytics analytics service (only subject to prior consent);
- the Data Controller’s tax advisers, accountants and legal advisers;
- public authorities and other bodies, where required by law.
The data is neither disclosed nor sold to third parties.
7. Transfer of data outside the European Union
Some suppliers (e.g. Google, Stripe, PayPal, Automattic) may also process data in the United States. In such cases, the transfer takes place on the basis of the European Commission’s adequacy decision relating to the EU-US Data Privacy Framework, for certified companies, or the Standard Contractual Clauses approved by the European Commission (Article 46 of the GDPR). A copy of the safeguards may be requested from the Data Controller.
8. Retention period
- Enquiries: for the time required to process the request and, in any event, for no longer than 12 months from the last contact, unless a contractual relationship is established.
- Contract details, orders and invoices: 10 years from the date the contract was concluded, as provided for by civil and tax law (Article 2220 of the Civil Code).
- Customer account: until the Customer requests deletion, subject to the retention periods applicable to orders.
- Data for promotional purposes: until such time as consent is withdrawn.
- Curriculum Vitae: no later than 24 months from receipt.
- Browsing data and technical logs: for the period strictly necessary to ensure the security and operation of the Website, unless it is necessary to investigate any unlawful acts.
- Statistical data (Google Analytics): in accordance with the timeframes set out in the cookie table (point 10).
9. Rights of the data subject
At any time, the data subject may exercise the rights set out in Articles 15–22 of the GDPR, in particular the right to:
- to access your data and receive a copy of it;
- to have inaccurate or incomplete data rectified or supplemented;
- to have data erased (“right to be forgotten”), in the cases provided for;
- to have the processing restricted;
- to receive the data in a structured, commonly used format and to transmit it to another data controller (data portability);
- to object to processing based on legitimate interests and, at any time, to processing for marketing purposes;
- to withdraw the consent given at any time, without affecting the lawfulness of the processing carried out prior to the withdrawal.
Enquiries should be sent to info@addicted-to.com or by post to COSTA CALDURA S.R.L., Via Vincenzo Cavallaro 13 – 90015 Cefalù (PA). The Data Controller will respond within one month of receiving the request.
The data subject also has the right to lodge a complaint with the Data Protection Authority (www.garanteprivacy.it) or to the supervisory authority of the EU Member State in which they live or work.
10. Cookie Policy
Cookies are small text files that the Website stores on the user’s device. This section has been drawn up in accordance with Article 122 of the Privacy Code and the “Guidelines on cookies and other tracking tools” issued by the Data Protection Authority on 10 June 2021.
Technical cookies (always active). These are necessary for the Website and the online shop to function (session, shopping basket, login, checkout, payment security, storage of cookie preferences) and do not require consent.
Analytical and third-party cookies (only with consent). They are only installed if the user consents via the banner.
| Cookies | Supplier | Purpose | Duration |
|---|---|---|---|
| woocommerce_cart_hash, woocommerce_items_in_cart, wp_woocommerce_session_* | Addicted to Nature (Part One) | Technical – managing the shopping basket and the shopping session | Course – 2 days |
| wordpress_logged_in_*, wordpress_sec_* | Addicted to Nature (Part One) | Technical – access to the customer account | Session – 14 days |
| CookieLawInfoConsent, cookielawinfo-checkbox-*, viewed_cookie_policy | Addicted to Nature (Part One) | Technical – stores the user’s cookie preferences | 1 year |
| trp_language | Addicted to Nature (Part One) | Technical – saves your chosen language | 30 days |
| __stripe_mid, __stripe_sid | Stripe | Specialist – payment fraud prevention | 30 minutes – 1 year |
| sbjs_* | Addicted To Nature (Part One, WooCommerce) | Analytics – source of the visit that led to an order | Session – 6 months |
| _ga, _ga_* | Google Ireland Ltd. (Google Analytics 4) | Analytics – aggregated statistics on the use of the website | Up to 2 years |
Third-party content. The Website may display content from social media platforms (e.g. the Instagram feed) and links to our profiles on Facebook, Instagram, YouTube and Pinterest. By clicking on these links, the user leaves the Website; the processing of data by these platforms is governed by their respective privacy policies: Meta/Instagram, Google/YouTube, Pinterest.
Consent management. When you first visit the site, a banner allows you to accept, reject or select non-technical cookies. You can change your preferences at any time via the “Cookie settings” link in the footer of the website. You can also block or delete cookies via your browser settings: Chrome, Firefox, Safari, Edge.
11. Changes to this policy
The Data Controller may update this privacy notice, including in response to changes in legislation or to the services offered. The current version is always published on this page, along with the date of the last update.