Privacy Policy

Last updated: July 31, 2026

This privacy policy describes how we process the personal data of users who make purchases or browse this website, in accordance with Article 13 of Regulation (EU) 2016/679 (“GDPR”).

1. Data Controller

The Data Controller is Guerra S.r.l., with registered office at Piazza Papa Giovanni XXIII, 12 — 74123 Taranto (TA), Tax ID and VAT Number 02359020738.

Contact information for exercising privacy rights or for any request regarding data processing: info@guerrastore.it — tel. +39 099 4532629 — PEC guerrasrl@pec.it.

2. Purposes and Legal Basis for Processing

Order fulfillment and performance of the contract (Art. 6, para. 1, subpar. b, GDPR): order management, payment processing, shipping, invoicing or recording of payment, management of returns, cancellations, and warranties, and customer support related to the order.
Compliance with legal and tax obligations (Art. 6, para. 1, letter c, GDPR): recording of payments in the register required by Art. 24 of Presidential Decree 633/1972, issuance of electronic invoices when explicitly requested by the customer, retention of accounting and tax records for legal compliance (see also Terms and Conditions of Sale , tax section).
Marketing (newsletters, commercial communications, promotional messages via email or WhatsApp) only with the data subject’s free, explicit, and specific consent (Article 6, paragraph 1, letter a, GDPR), obtained separately from the consent required to fulfill the order. Consent for marketing purposes may be revoked at any time, without affecting the fulfillment of an order already in progress.
Request for a post-sale review via the Feedaty platform, based on the Data Controller’s legitimate interest in collecting feedback on the service (Art. 6, para. 1, subpar. f, GDPR), with the option for the customer to decline the request.

3. Categories of Data Processed

Identification and contact information : first name, last name, shipping and/or billing address, email address, phone number.
Order-related data : products purchased, amounts, order date and status, any request for an invoice, and related tax information (customer’s tax ID or VAT number, if an invoice is requested).
Payment data : This data is neither processed nor stored directly by Guerra S.r.l. The payment transaction is managed entirely by the Shopify platform (Shopify Payments) and the integrated payment gateways—PayPal, Axerve/Banca Sella (GestPay), Klarna, Scalapay — which act as independent data controllers or data processors for payment data in accordance with their respective privacy policies. Guerra S.r.l. does not have access to complete payment card data.
Browsing data and cookies : collected through the website and related analytics tools—see the Cookie Policy for details.

4. Recipients and External Data Processors

Personal data may be disclosed, to the extent strictly necessary for the purposes indicated above, to the following external parties, which act as data processors (Art. 28 GDPR) or as independent data controllers for the portion falling within their purview:

Shopify Inc. (and companies in the Shopify group): an e-commerce platform that hosts the website, manages orders, checkout, and payment infrastructure (Shopify Payments).
Payment gateways : PayPal, Axerve/Banca Sella (GestPay), Klarna, Scalapay — for payment processing.
Couriers and shipping carriers : DHL, Packlink PRO — for the physical delivery of goods; only the data necessary for shipping (name, address, phone number) is provided to them.
Feedaty : a platform for collecting certified reviews, to which the data necessary to contact the customer after delivery to request a review is provided.
WhatsApp Business API provider : used to send automated order notifications (order confirmation, shipping updates/tracking) — only outbound communications related to the order; no conversational customer support at this stage.
Any tax or accounting advisors responsible for bookkeeping and tax compliance.
Public authorities, when required by law.

5. Retention Periods

Contractual and tax data (orders, invoices, payments): retained for the period required by civil and tax laws governing accounting records (Art. 2220 of the Italian Civil Code and applicable tax regulations).
Data collected for marketing purposes : retained until the data subject revokes consent, or in any case for a maximum period of 24 months of user inactivity, after which it is deleted or anonymized, unless a different term is expressly indicated at the time consent is collected.
Browsing data and cookies : see the Cookie Policy .

6. Rights of the Data Subject

As a data subject, the customer has the right to request at any time from Guerra S.r.l.:

access to their personal data (Art. 15 GDPR);
correction of inaccurate or incomplete data (Art. 16 GDPR);
erasure of your data, to the extent compatible with tax retention obligations (Art. 17 GDPR);
restriction of processing (Art. 18 GDPR);
data portability in a structured format (Art. 20 GDPR);
objection to processing, particularly for marketing purposes (Art. 21 GDPR).

Requests may be sent to info@guerrastore.it. You may also file a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

7. Data Transfers to Countries Outside the EU

Some of the third parties listed above—in particular Shopify and any related third-party services (e.g., Meta/Google advertising tools, if and when activated)—have offices or infrastructure located outside the European Economic Area (e.g., the United States). These transfers outside the EU are carried out based on the safeguards provided for in Chapter V of the GDPR, typically the Standard Contractual Clauses adopted by the European Commission, as stated in the respective privacy policies of Shopify and the individual third-party providers.

This point must be re-verified and updated promptly when tracking pixels or specific advertising integrations are definitively activated (see Phase 5 of the B2C spec — GEO/Local SEO), as each new tool may introduce a new recipient and a new transfer that must be explicitly declared.

8. Changes to This Policy

Guerra S.r.l. reserves the right to update this privacy policy. Any substantial changes will be communicated via publication on the website, indicating the date of the last update.