Privacy Policy

1. Data Controller

The Data Controller responsible for processing your personal information is: CavePark s.r.l. P.IVA / VAT: IT06204700873 | REA: CT - 478076 | Share Capital €10.000,00 Registered Office: Via Vincenzo Giuffrida 202, 95128 Catania (CT), Italy, Europe.
Contact Email: privacy@cavepark.com

2. Categories of Processed Data

• Personal Contact Details: Name, surname, email address, phone number.
• Tax Identification Data: Codice Fiscale (for Italian B2C invoices), Partita IVA, SDI Code, and PEC address (for Italian B2B invoices).
• Delivery Data: Shipping addresses, postal codes, country of destination.
• Authentication & System Logs: Session identifiers, IP address, device security logs, browser type.

3. Legal Purposes and Bases of Processing

We process your data strictly under the following legal frameworks:

• Performance of a Contract (Art. 6(1)(b) GDPR): To process merchandise orders, deliver physical goods, provide digital stem access, manage VIP memberships, and handle customer support.
• Compliance with a Legal Obligation (Art. 6(1)(c) GDPR): To fulfill statutory tax, accounting, and anti-fraud rules in Italy (such as transmitting electronic invoices to the Agenzia delle Entrate).
• Legitimate Interest (Art. 6(1)(f) GDPR): To ensure website security, prevent fraudulent transactions, debug software issues, and send transactional emails (e.g., VIP membership renewal alerts).

4. Data Processors & Third-Party Receivers

Your data is shared only with secure, compliant service providers acting as Data Processors:

• Supabase Inc.: User identity authentication and cloud database infrastructure.
• Stripe Payments Europe, Ltd.: Secure payment processing (PCI-DSS Level 1 compliant).
• Fattura24 S.r.l.: Tax document generation and electronic invoice transmission.
• Vercel Inc.: Web application edge hosting and deployment infrastructure.

5. International Data Transfers

Some of our data processors (such as Supabase, Stripe, and Vercel) are headquartered in the United States. Transfers of personal data outside the European Economic Area (EEA) are safeguarded via the EU-U.S. Data Privacy Framework adequacy decision or through the execution of standard contractual clauses (SCCs) approved by the European Commission, ensuring an equivalent level of data protection.

6. Data Retention Periods

We retain your personal data only as long as necessary to fulfill the purposes outlined:

• Contractual Data (Account & Orders): Kept for the duration of your active relationship with us.
• Tax and Financial Records: Retained for 10 years from the date of issuance, as strictly mandated by Article 2220 of the Italian Civil Code.
• Security Logs: Retained for a maximum of 90 days, unless longer storage is required to investigate security incidents.

7. Your Rights Under the GDPR

Pursuant to Articles 15-22 of the GDPR, you have the right to request access to, rectification of, or erasure of your personal data. You also hold the right to data portability, restriction of processing, and the right to object to processing. To exercise these rights, please submit a written request to privacy@cavepark.com.