Privacy Policy

The data controller is [FILL IN — legal entity name], trading as AMLA The Label, [FILL IN — registered address]. Contact for privacy matters: [FILL IN — contact email].

When you place an order, we collect your name, email address, phone number (if given), shipping and billing address, and details of what you've ordered. We don't operate customer accounts or a login system, so this is collected fresh at checkout each time. We also collect basic technical data (like IP address) needed to operate the site securely.

We use your order data to fulfil the contract with you — processing payment, arranging delivery, handling returns, and providing customer support (Article 6(1)(b) GDPR). We use it to meet our legal obligations, such as tax and accounting record-keeping (Article 6(1)(c) GDPR). If you opt in to marketing emails via the checkbox at checkout, we'll use your email for that on the basis of your consent (Article 6(1)(a) GDPR), which you can withdraw at any time.

We share the minimum data necessary with the following processors, each acting under a data processing agreement: Stripe (payment processing), Supabase (database and storage hosting), Vercel (website hosting), Cloudflare (content delivery / image optimisation), Resend (transactional emails — order and shipping confirmations), and Packlink PRO (shipping label generation and carrier coordination). We don't sell your data, and we don't share it with advertisers.

Some of our processors may store or process data outside the European Economic Area. [CONFIRM: hosting region(s) for Supabase and Vercel for this project — if outside the EEA, this section should name the transfer safeguard used, e.g. EU Standard Contractual Clauses.]

Order and invoice records are kept for as long as required by Italian tax and accounting rules (as a starting point, this is generally 10 years from the relevant tax year under Italian civil and tax record-keeping requirements — [CONFIRM this figure with your accountant for your specific entity type]). If you've opted into marketing emails, we keep your email for that purpose until you unsubscribe or withdraw consent.

We only use strictly necessary cookies — for example, to keep items in your cart and maintain your session and language preference. We do not currently use analytics, advertising, or tracking cookies.

Under the GDPR, you have the right to access, correct, delete, or restrict the use of your personal data, to object to processing, and to data portability. To exercise any of these rights, contact us at [FILL IN — contact email].

If you believe your data hasn't been handled properly, you have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma, website www.garanteprivacy.it.

Given the size and nature of our processing activities, we don't currently believe a Data Protection Officer is legally required under Article 37 GDPR. [CONFIRM this assessment as the business grows or processing activities change.]