Policies

Privacy Policy

What we collect, why, and the control you keep over it.

This policy explains what personal data Calvieri collects, why we collect it, and what control you have over it. It is written to meet the requirements of Regulation (EU) 2016/679 (GDPR).

• Who we are
• Data we collect
• Why we use it
• Cookies
• Who we share it with
• International transfers
• How long we keep it
• Your rights
• Marketing
• Security
• Children
• Automated decisions
• Changes
• Contact and complaints

1. Personal data we collect

   You give us directly

   • Name, email address, telephone number
   • Billing and delivery address
   • Order contents and order history
   • Correspondence you send to customer support
   • Account credentials, if you create an account
   • Marketing preferences

   Collected automatically

   • IP address, browser type and version, device type, operating system
   • Pages viewed, referring URL, time and duration of visits
   • Cookie and similar identifiers (see section 4)

   We never receive

   Full payment card numbers. Card details are entered directly into our payment processor and are never transmitted to or stored by Calvieri. We receive only the payment result and the last four digits for reconciliation.

   We do not collect special categories of personal data as defined in Article 9 GDPR.

2. Why we use your data, and on what legal basis

   Purpose	Data used	Legal basis (Art. 6 GDPR)
   Processing and delivering your order	Identity, contact, address, order	Performance of a contract — 6(1)(b)
   Taking payment and preventing fraud	Payment result, IP, order	Contract 6(1)(b); legitimate interests 6(1)(f)
   Handling returns and refunds	Identity, contact, order, bank reference	Contract 6(1)(b); legal obligation 6(1)(c)
   Customer support	Identity, contact, correspondence	Contract 6(1)(b); legitimate interests 6(1)(f)
   Marketing emails	Email, name, preferences	Consent 6(1)(a)
   Analytics and site improvement	Usage data, device, cookies	Consent 6(1)(a) for non-essential cookies
   Accounting and tax records	Order, invoice, identity	Legal obligation 6(1)(c)
   Establishing or defending legal claims	As relevant	Legitimate interests 6(1)(f)

   Where we rely on legitimate interests, we have assessed that our interest in operating a secure and functioning shop does not override your rights and freedoms. You may object at any time — see section 8.

3. Cookies and similar technologies

   Strictly necessary cookies keep your basket, session and checkout working. They cannot be disabled and do not require consent.

   Analytics cookies tell us which pages are used and where visitors leave. Marketing cookies measure advertising and may allow advertising platforms to show you relevant ads. Both are placed only after you consent.

   You can accept, refuse or change your choices at any time through the cookie banner or your browser settings. Refusing non-essential cookies does not affect your ability to browse or order.

   [Liste aqui os cookies concretos que sua loja usa — nome, finalidade, duração e fornecedor. Sob o GDPR e a Diretiva ePrivacy, uma lista genérica não basta. A maioria dos apps de consentimento do Shopify gera essa tabela automaticamente.]

4. Who we share your data with

   We do not sell your personal data. We share it only with service providers who process it on our instructions, under a data processing agreement:

5. International transfers

   Some providers process data outside the European Economic Area. Where this occurs, the transfer is protected by one of the safeguards permitted under Chapter V GDPR — an adequacy decision of the European Commission, or Standard Contractual Clauses adopted by the Commission together with supplementary measures where required.

   You may request a copy of the relevant safeguards by writing to privacy@calvieri.com.

6. How long we keep your data

   Category	Retention period
   Order and invoice records	[7–10] years, as required by tax law in [COUNTRY]
   Account data	Until you delete the account, then [30] days
   Support correspondence	[24] months from last contact
   Marketing consent records	Until withdrawn, plus [24] months as proof of consent
   Analytics data	[14] months

   When a retention period ends, data is deleted or irreversibly anonymised.

7. Your rights

   Under the GDPR you have the right to:

   • Access — obtain confirmation of whether we process your data and receive a copy of it
   • Rectification — have inaccurate data corrected and incomplete data completed
   • Erasure — have your data deleted where one of the grounds in Article 17 applies
   • Restriction — require us to limit processing in the circumstances of Article 18
   • Portability — receive data you provided in a structured, machine-readable format and have it transmitted to another controller
   • Object — object to processing based on legitimate interests, and to direct marketing at any time and without justification
   • Withdraw consent — at any time, without affecting the lawfulness of processing carried out before withdrawal

   To exercise any right, write to privacy@calvieri.com. We respond within one month, extendable by two further months for complex requests, in which case we will tell you within the first month. Exercising your rights is free of charge.

8. Marketing

   We send marketing email only with your consent. Every message contains a one-click unsubscribe link, and you may also write to privacy@calvieri.com.

   Unsubscribing from marketing does not stop transactional messages such as order confirmations, dispatch notices and return instructions, which are necessary to perform the contract.

9. Security

   The site is served over TLS encryption. Access to personal data is restricted to personnel who need it, and our processors are contractually bound to appropriate technical and organisational measures under Article 32 GDPR.

   No system is completely secure. In the event of a personal data breach likely to result in a high risk to your rights and freedoms, we will notify you without undue delay and inform the competent supervisory authority within 72 hours as required by Articles 33 and 34.

10. Children

    Calvieri sells adult menswear and the shop is not directed at children. We do not knowingly collect data from persons under [16]. If you believe a child has provided us with personal data, contact privacy@calvieri.com and we will delete it.

11. Automated decision-making

    We do not carry out automated decision-making producing legal or similarly significant effects within the meaning of Article 22 GDPR. Automated fraud screening may flag a transaction for review, but any decision to cancel an order is taken by a person.

12. Changes to this policy

    We may update this policy to reflect changes in our practices or in the law. The date at the top of the page shows when it was last revised. Where changes are material, we will notify you by email or a notice on the site before they take effect.

13. Contact and complaints

    Data protection enquiries: privacy@calvieri.com
    

    If you are not satisfied with our response, you have the right to lodge a complaint with a supervisory authority — in particular in the Member State of your habitual residence, place of work, or of the alleged infringement.