Privacy Policy
PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA pursuant to Article 13 of EU Regulation 2016/679 (GDPR)
This notice describes how BABYPROM – Matriosca di Shynkarenko Liliya, as Data Controller, collects and processes the personal data of users and customers (“Data Subjects”) through the website https://babyprom.com/.
1. Data Controller
The Data Controller is:
Matriosca di Shynkarenko Liliya
Registered office: Via Gorizia n. 10 int. 5, 44121 – Ferrara (FE), Italy
Tax ID and VAT number: 01744440387
Email: babypromtoy@gmail.com
PEC: slavun@pec.it
The Data Controller is committed to protecting confidentiality and the rights of Data Subjects. All processing will be carried out lawfully, fairly and transparently, with data protection by design and by default.
2. Source and categories of personal data
Personal data may be provided directly by the Data Subject or collected from third parties.
Identification and contact data: first name, surname, residential/domicile address, shipping address, email address, telephone number.
Purchase data: products purchased, amounts, order history.
Payment data: payment details (e.g. card numbers) are not processed or stored by the Controller but are handled by secure payment platforms (e.g. PayPal, Stripe), which act as independent controllers. The Controller receives only confirmation of payment.
Browsing data: IP addresses, host names, request times and other parameters relating to the user’s IT environment, collected via cookies.
3. Purposes and legal bases
Personal data are processed for the following purposes:
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
A) Order management and contractual performance: processing purchase orders, shipping products, managing payments, after-sales support, returns and warranties. |
Performance of a contract or pre-contractual measures at the Data Subject’s request. |
B) Legal obligations: accounting, tax compliance (e.g. invoicing), legal warranty. |
Legal obligation to which the Controller is subject. |
C) Marketing communications (newsletter): emailing promotional material, special offers and product updates. |
Consent of the Data Subject (freely given, specific, informed and revocable at any time). |
D) Soft spam: promotional emails about products similar to those already purchased. |
Legitimate interest of the Controller (Art. 130(4) Italian Privacy Code), subject to objection (opt-out). |
E) Fraud prevention and protection of rights: establishing, exercising or defending legal claims. |
Legitimate interest of the Controller. |
4. Nature of provision
Provision of data for purposes A) and B) is mandatory. Failure to provide data makes it impossible to complete a purchase.
Provision for purpose C) is optional. Refusal does not prevent purchases on the site.
5. Processing methods and retention
Data are processed using manual and electronic tools, with security and confidentiality.
The Controller undertakes to: ensure accuracy and updating; implement appropriate technical and organisational measures; comply with data breach notification duties (Arts. 33–34 GDPR); and maintain regulatory compliance.
Retention periods:
Purposes A) and B): for the duration of the relationship and, thereafter, 10 years for legal (tax/accounting) obligations.
Purpose C): until withdrawal of consent.
Purpose D): until objection (opt-out).
6. Recipients
Data may be disclosed to authorised personnel and to processors (Art. 28 GDPR), including carriers, IT and hosting providers, tax/legal advisers and marketing service providers. Data may be disclosed to public authorities where required by law. A full list of processors is available on request.
7. Transfers outside the EU
Personal data are stored on servers within the European Union. No transfers outside the EEA are envisaged for hosting; where processors (e.g. payment or analytics providers) transfer data internationally, appropriate safeguards (e.g. SCCs) apply as required by the GDPR.
8. Rights of the Data Subject
You may at any time request: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), objection (Art. 21) and withdrawal of consent without affecting prior lawfulness.
Requests: babypromtoy@gmail.com.
9. Right to complain
You may lodge a complaint with the Italian Data Protection Authority (www.gpdp.it) or seek judicial remedy.
10. Updates
This notice may be updated. The latest version will always be published on this page.
Last updated: 24/04/2026