Privacy policy

Last updated: 18 September 2026

1. Data controller and scope

This notice describes the processing of personal data in connection with the store store.profumieradivenezia.it, purchases, customer assistance and related communications.

The data controller is VAGANOVA IRINA, a sole proprietorship trading as La Profumiera di Venezia by Irina Vaganova, with its registered office at Via Triestina 10/C, 30173 Venice (VE), Italy. Laboratory: Via Caneve 17, 30173 Venice (VE), Italy. VAT number: 04648030270; Italian tax code: VGNRNI81A69Z135O; REA registration: VE-442527. You can contact us at info@profumieradivenezia.it or +39 366 978 1845.

The privacy notice of the main website also applies to the main website, information requests, the olfactory profile test and newsletter registration forms. Reading a privacy notice or simply using a website does not constitute consent to marketing or optional cookies.

2. What data we process and where it comes from

We process information you provide when making a purchase, managing an account, contacting us or expressing a preference: first and last name, email address, telephone number, billing and delivery addresses, any applicable tax details, products and quantities, amounts, payment status, orders, shipments, returns, refunds and the content of communications. For customer accounts, we process the identification and authentication data required by the available sign-in method.

Payment providers process the information required to authorise a transaction. We receive the information needed to record and manage the payment, such as its result, amount and transaction reference; we do not receive the card security code. Complete payment instrument details are managed by the provider selected at checkout under that provider's privacy notice.

The store and its service providers may collect technical information such as IP address, browser, device, pages visited, date and time, browsing events and consent preferences. Data necessary for the operation of the store is distinguished from data collected through optional analytics and advertising tools. We also receive the updates from payment and delivery providers needed to manage your order.

3. Purposes and legal bases for processing

Purchases, accounts and customer support: we use the data necessary to respond to enquiries, manage your cart and account, conclude and fulfil orders, collect payment, deliver products, organise purchased services and handle returns and guarantees. The legal basis is the performance of a contract or pre-contractual steps taken at your request under Article 6(1)(b) of the GDPR.

Administrative and tax obligations: we process the information necessary for invoicing, accounting and other applicable obligations on the basis of Article 6(1)(c) of the GDPR.

Security and protection of rights: technical and transaction data may be used to prevent unauthorised access, fraud and malfunctions and to manage disputes. The legal basis is the legitimate interest in protecting the store, customers and the controller's rights, with due regard for the rights of data subjects, under Article 6(1)(f) of the GDPR.

Newsletters and promotions: subscribing to the La Profumiera di Venezia newsletter requires a specific choice. Communications may concern perfumery, news, products, courses, workshops and offers. The legal basis is consent under Article 6(1)(a) of the GDPR. Making a purchase, requesting support, completing a test or requesting a PDF does not, in itself, constitute consent to receive the newsletter. Communications necessary to fulfil an order or requested service remain separate from promotional messages.

Optional analytics and advertising: the use of non-essential cookies or similar technologies requires consent where applicable law so provides. Newsletter choices do not replace choices regarding cookies and personalised advertising.

4. Providing personal data

Information marked as required is necessary to process your order, payment or requested service. Without it, we may be unable to complete your request. Consent to marketing is optional: refusing or withdrawing it does not prevent you from making purchases or receiving assistance. Please avoid sending health information or other unnecessary special-category personal data.

5. Shopify and the store's service providers

The store uses Shopify to host and operate the platform, customer accounts, orders and commerce functions. Shopify processes data to provide these services and, for certain features, also for its own purposes, as described in its consumer privacy notice.

Shopify Network Intelligence is currently enabled. As part of Shopify's advanced features, information about interactions with our store may be securely combined with information from Shopify and other merchants to protect, improve and personalise services, optimise certain checkout functions and support advertising and measurement. Where Shopify independently determines the purposes and means of such processing, Shopify is directly responsible for the relevant requests. You can consult Shopify's privacy portal. Your choices and local law continue to apply to processing that requires consent.

To the extent necessary, data is disclosed to payment providers, carriers, IT and customer support service providers, accounting and professional advisers, persons authorised by the controller and public authorities where required by law. Service providers act as processors when processing data on our behalf, or as independent controllers for activities under their own responsibility.

The brand's newsletter is also managed through SendPulse. Using a contact in another mailing platform must comply with the original purpose and the person's choices: an email address appearing in Shopify orders does not automatically authorise its import into a promotional mailing list. For SendPulse forms and Quaderno materials, please refer to the main website's privacy notice.

6. Cookies and advertising choices

Essential cookies support functions such as the cart, authentication and security. Optional technologies may measure browsing and conversions or help display relevant advertisements. You can manage your choices through the preference controls available on the website; you can also contact us for clarification about data processing.

For users covered by certain US privacy laws, disclosure of data for targeted advertising may fall within the definitions of a data “sale” or “sharing”. The Your Privacy Choices page enables you to exercise applicable rights. Global Privacy Control signals are handled where required by law and supported by Shopify's features. These options do not replace the consent required in the European Economic Area.

7. Transfers outside the European Economic Area

Using international service providers may involve processing in countries outside the European Economic Area, including the United States. Transfers subject to the GDPR require an adequacy decision applicable to the recipient or appropriate safeguards, such as the European Commission's Standard Contractual Clauses and any necessary supplementary measures. To request information about recipients and safeguards relating to your data, or to obtain a copy where permitted, contact the data controller.

8. Data retention

We keep account data for as long as the account is active or needed to provide the service. Order and administrative records are retained to perform the contract and for the periods required by tax and accounting law. Documents needed for a dispute are retained for the handling of that dispute and the applicable periods for protecting legal rights. Deleting an account does not delete documents that we are legally required to retain.

Customer support requests are retained to respond and manage any ensuing relationship or dispute. Newsletter contacts are used while the purpose remains valid and until consent is withdrawn. After unsubscribing, we may retain only the data needed to document the choice and prevent accidental re-importation. Evidence of consent is retained to demonstrate the lawfulness of communications and manage potential disputes, with restricted access. Technical data is retained for as long as necessary for the operation and security of the service; cookie durations are indicated in the information and preference tools available on the site.

9. Security and minors

We adopt technical and organisational measures proportionate to the risks and restrict access to personal data to those who need it for their duties. Do not send passwords or complete payment card information by email. The store is intended for people who can lawfully enter into purchase contracts. If you wish to report a minor's data submitted without an appropriate legal basis, please contact the controller.

10. Rights, withdrawal of consent and complaints

Where provided for by the GDPR, you may request access to, rectification or erasure of your personal data, restriction of processing and data portability. You may object to processing based on legitimate interests for reasons relating to your particular situation, and you may object at any time to direct marketing, including related profiling.

You can withdraw newsletter consent using the unsubscribe link in an email or by writing to info@profumieradivenezia.it. Withdrawal does not affect the lawfulness of processing already carried out. Necessary service communications may continue.

You may use the same contact details to exercise your rights. We may request only the information necessary to verify your identity. We normally respond within one month; if the GDPR permits an extension, we will notify you within that period and explain the reasons. You may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or another competent supervisory authority.

11. External links and updates

When you access external services, their providers' privacy notices also apply. This notice may be updated to reflect changes to services or data processing. The date at the top identifies the current version; an update does not replace renewed consent where consent is required.