Privacy Policy

(Information pursuant to Articles 12, 13 and 14 of the European General Data Protection Regulation No. 2016/679 – Privacy Notice pursuant to Article 13 of Legislative Decree 196/2003)

This page describes the privacy policies adopted by the company Flavors4you Srl in relation to the processing of personal data, both via its official websites and in the course of its normal business activities. Please note that ‘personal data’ refers to any information relating to an identified or identifiable natural person.

Should the information provided be deemed unclear or insufficient, you may:

– contact the Data Controller using the contact details provided below;

– visit the website of the Data Protection Authority (www.garanteprivacy.it).

1. GENERAL INFORMATION, APPLICABLE TO ALL AREAS OF DATA PROCESSING:

Information notice pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (‘GDPR’) and Legislative Decree 196/2003 (‘Privacy Code’), as amended by Legislative Decree 101/2018.

On this page, Flavors4you S.r.l. explains how it processes the personal data of those who visit its websites, make purchases via the blendfeel.com online shop, request information or assistance, subscribe to the newsletter, and of the customers and suppliers with whom it works. Personal data means any information relating to an identified or identifiable natural person.

1. Data Controller

Flavors4you S.r.l., Via Don Luigi Sturzo 21/23, 20822 Seveso (MB), Italy.

• Telephone: +39 02 39465995
• Email: amministrazione@flavors4you.com

2. What data we process, why and on what basis

2.1 Website browsing and security

Whilst you are browsing, our servers record technical data: IP address, date and time, page requested, result of the request, browser and operating system. We use this data to ensure the websites function properly, to protect them from misuse and attacks, and to investigate any cybercrimes, including at the request of the judicial authorities.

• Legal basis: the Data Controller’s legitimate interest in the security of its systems (Article 6(1)(f) of the GDPR).
• Retention period: up to 90 days, unless the data is required for a longer period to investigate an offence.

2.2 Cookies and statistics

The websites use technical cookies, statistical cookies and, only with your consent given via the banner, marketing cookies (Google Analytics and the Meta/Facebook pixel). Matomo statistics are processed on our servers. Further details can be found in the Cookie Policy. You can change your preferences at any time via the banner.

2.3 Customer accounts and orders

To register and make a purchase, we process your first name and surname, email address, telephone number, delivery and billing addresses, tax code or VAT number, company details for business customers, and order history.

• Legal basis: performance of the sales contract and pre-contractual measures (Article 6(1)(b) of the GDPR); compliance with statutory accounting and tax obligations, and those relating to the sale of products subject to excise duty (Article 6(1)(c) of the GDPR).
• Retention: account data for as long as the account remains active or until you request its closure; orders, invoices and accounting documents for 10 years (Article 2220 of the Civil Code).

2.4 Age verification (private customers)

The law prohibits the sale of e-cigarettes and nicotine-containing refill liquids to persons under the age of 18, and obliges sellers to request proof of identity where the person’s age is not evident (Article 25 of Royal Decree 2316/1934, as replaced by Article 24(3) of Legislative Decree 6/2016); the Customs and Monopolies Agency extends this obligation to nicotine-free e-liquids. For this reason, prior to the first payment, we ask private customers for the type of identity document, date of birth, expiry date of the document and a photograph of the identity document; we also record the IP address and browser at the time of submission.

• Legal basis: compliance with a legal obligation (Article 6(1)(c) of the GDPR).
• Retention: photographs of the identity document are deleted within 10 days of verification; the verification result, date of birth and date of verification are retained for as long as the account remains active.
• Photographs are stored in an area not accessible via the web and are viewed only by authorised staff.

2.5 Payments

Card payments are processed via the Nexi platform, which handles them as an independent data controller: we neither see nor store card numbers. For bank transfers and cash on delivery, we process the payment details necessary to record the transaction.

2.6 Deliveries

To deliver orders, we provide the recipient’s name, address, telephone number and email address to the couriers GLS, Duebi S.r.l. (logistics) and Mail Boxes Etc. For shipments outside the European Union, the data is also passed on to the courier in the country of destination, as this is necessary for the performance of the contract (Article 49(1)(b) of the GDPR).

2.7 Proof of acceptance of the terms and conditions and consents

When you accept the terms and conditions of sale, subscribe to the newsletter or give your consent, we record which text you have read (document, version and language), when and where (website and page), the truncated IP address (the last few digits are not retained) and an encrypted hash of the email address, not the plaintext email address. This is used to demonstrate what you accepted and when.

• Legal basis: the obligation to demonstrate consent (Article 7(1) of the GDPR) and the Data Controller’s legitimate interest in proving the content of the contract (Article 6(1)(f) of the GDPR).
• Retention period: 10 years from the date of recording; after this, the record loses the IP address, email fingerprint and browser details.

2.8 Requests for information and support

If you contact us via the website forms, by email or via the support portal, we process the data you provide in order to reply. The support portal has its own privacy notice, which you should read before submitting your enquiry, including regarding any health data that may be contained in your message.

• Legal basis: pre-contractual measures or a contract (Article 6(1)(b) of the GDPR); your consent for health data (Article 9(2)(a) of the GDPR).
• Retention period: 24 months from the last communication, unless the enquiry becomes an order or a complaint, in which case the retention period will follow the applicable timeframes for those.

2.9 Newsletters and marketing communications

We will only send you newsletters and promotional communications if you have subscribed and given your consent, which you may withdraw at any time via the link at the bottom of each message, via your account or by writing to us. Withdrawal does not affect the lawfulness of previous communications (Article 7(3) of the GDPR). We use the Brevo platform (Sendinblue SAS, France) to send these communications.

• Legal basis: consent (Article 6(1)(a) of the GDPR).
• Retention: until consent is withdrawn; thereafter, we retain only proof of subscription and withdrawal (point 2.7).

2.10 Corporate clients, resellers and suppliers

In our dealings with corporate clients, resellers and suppliers, we process the data of contact persons (name, role, contact details) to manage quotations, orders, contracts, sales representative visits, invoicing and payments.

• Legal basis: contract and pre-contractual measures (Article 6(1)(b) of the GDPR); legal obligations (Article 6(1)(c) of the GDPR).
• Retention period: for the duration of the relationship and then for 10 years for accounting documents (Article 2220 of the Civil Code).

3. To whom we disclose data

Within Flavors4you, data is processed only by employees and contractors who are authorised and trained to do so (Article 29 of the GDPR and Article 2-quaterdecies of the Privacy Code), each limited to the data necessary for their work: for example, the administration department for invoices and payments, the logistics department for deliveries, and the customer service department for support.

Outside the company, to the extent necessary for each party’s purposes, data is processed by the following entities, designated as data processors (Article 28 of the GDPR) or independent data controllers:

• server and hosting provider (OVHcloud, data centre in the European Union);
• payment platform (Nexi);
• couriers and logistics providers (GLS, Duebi S.r.l., Mail Boxes Etc.);
• newsletter platform (Brevo);
• accounting and invoicing software (Contabilità Facile) and business management software (Odoo, the Odoo.sh service provided by Odoo SA, Belgium);
• accountants, legal advisers and solicitors;
• VAT-registered sales agents, for business customers in their area;
• Google and Meta, solely for the marketing cookies to which you have consented;
• public authorities, where required by law (for example, the Italian Revenue Agency and the Italian Customs and Monopolies Agency).

Data is neither disclosed nor sold.

4. Transfers outside the European Union

Google and Meta may process data collected via marketing cookies in the United States. This transfer is based on the European Commission’s adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework, to which both companies adhere, and takes place only with your consent to cookies. For shipments outside the EU, the provisions set out in section 2.6 apply. There are no other transfers outside the European Union.

5. Mandatory and optional data

The data required for your account, order, delivery and age verification is essential: without it, we cannot register you or fulfil your order. Subscribing to the newsletter and accepting non-essential cookies is optional and does not affect your purchases in any way.

6. Your rights

You may at any time request access to your data, have it corrected, have it erased, restrict its processing, receive it in a machine-readable format (data portability) and object to processing based on legitimate interests (Articles 15–21 of the GDPR). You may withdraw any consent you have given at any time. We do not make decisions based solely on automated processing (Article 22 of the GDPR).

To exercise your rights, please write to amministrazione@flavors4you.com or to the address given in point 1. We will reply within one month, which may be extended by a further two months in complex cases (Article 12(3) of the GDPR).

If you believe that the processing infringes the law, you may lodge a complaint with the Data Protection Authority (www.garanteprivacy.it), or to the supervisory authority in the country where you live or work (Article 77 of the GDPR).

7. Changes to this policy

This policy may change. Each version has a number and an effective date; previous versions remain available at the bottom of this page.