Privacy policy

Privacy Policy

This privacy policy is provided pursuant to Regulation (EU) 2016/679 (the “GDPR”) and Italian Legislative Decree 196/2003, and describes how the personal data of users who browse and shop on extra-large.it is processed.

1. Data Controller

The data controller is EXTRA LARGE, with registered office at Via Barberini 70-72, 00187 Rome (RM), Italy – VAT no. 01296091000.
Contact: tel. +39 06 42884377 – e-mail info@extra-large.it.

2. Types of data collected

Identification and contact data: first name, last name, address, e-mail, telephone number, provided when registering, ordering or requesting support.
Order data: products purchased, shipping and billing address, order history.
Payment data: managed directly by the payment service providers; the controller does not store full card details.
Browsing data and cookies: IP address, browser type, pages visited, collected through cookies and similar technologies (see section 9).

3. Purposes and legal bases of processing

Management of purchases and requested services (performance of a contract – art. 6.1.b GDPR): order fulfilment, shipping, support, returns management.
Legal obligations (legal obligation – art. 6.1.c GDPR): invoicing, tax and accounting obligations.
Marketing and newsletter (consent – art. 6.1.a GDPR): sending promotional communications, only subject to optional and revocable consent.
Security, fraud prevention and improvement of the site (legitimate interest – art. 6.1.f GDPR).

4. Method of processing

Data is processed using electronic tools, adopting appropriate technical and organisational measures to ensure its security, confidentiality and integrity, and to prevent unauthorised access.

5. Retention period

Order data is retained for the time necessary to perform the contract and, thereafter, for the period required by tax and legal obligations (generally 10 years). Data processed for marketing purposes is retained until consent is withdrawn.

6. Data recipients

Data may be disclosed to parties acting as data processors, including:

Shopify International Ltd / Shopify Inc., provider of the e-commerce platform and hosting services;
couriers and logistics operators, for the delivery of orders;
payment service providers, for the management of transactions;
consultants, professionals and IT service providers, within the limits of their respective functions.

Data is neither disseminated nor transferred to third parties for their own purposes without consent.

7. Transfer of data outside the EU

Some providers (e.g. Shopify) may process data outside the European Union. In such cases the transfer takes place in compliance with the GDPR, on the basis of adequacy decisions or standard contractual clauses approved by the European Commission.

8. Rights of the data subject

As a data subject you may exercise at any time the rights provided for by articles 15-22 of the GDPR: access, rectification, erasure, restriction, portability, objection to processing and withdrawal of consent. You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

To exercise your rights, write to info@extra-large.it.

9. Cookies

The site uses technical cookies, necessary for its operation, and – subject to consent – analytics and profiling cookies, including third-party cookies. You can manage your preferences through the dedicated banner and your browser settings.