Datenschutzerklärung

The controller is SHORTIQLAB STUDIOS ECOM - FZCO, licence 88880, Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates; privacy contact info@giovenza.com. This notice concerns browsing, accounts, wishlist, orders, support/withdrawal requests and actually enabled measurement. GDPR applies where its territorial conditions are met. The applicable UAE regime, including Federal Decree-Law 45/2021 and any relevant free-zone rules, must be established for the company.

Data may include name, email, phone, addresses, account/session details, selected items/variants, wishlist, basket, order references and consumer statements. Support may contain information voluntarily supplied; do not send unnecessary identity documents, health data or full card numbers. Infrastructure/security may process IP, browser, device and log data. Preview checkout is not proof of a purchase or charge. AI Fit, AI credits and body profiling are not enabled by this notice.

Requested account/service functions, purchases and withdrawal communications may rely on contract or precontract measures. Invoicing, warranties and compliance rely on actual legal obligations. Security, abuse prevention and legal defence may rely on documented, balanced legitimate interests. Optional analytics and advertising rely on consent. Contract acceptance, browsing or possession of an email address is not advertising consent.

UAE lawful grounds are not automatically identical to GDPR. Valid consent and statutory exceptions, including necessary contractual/legal processing, must be assessed alongside consumer-protection restrictions. GDPR legitimate interests are not represented as a blanket UAE authorisation. Customer-data marketing needs a specific local assessment; these terms do not authorise uploading customer lists or order records to advertising platforms.

Lovable Cloud supports identity, profile and wishlist; external WooCommerce supports catalogue and commercial order records. Order access is linked to verified identity rather than an arbitrary visitor-supplied customer ID. Basket and recent searches may persist locally; identified baskets may be retained for service continuity/recovery. This neither concludes purchases nor consents to promotions. Account deletion does not automatically erase records legally needed for tax, warranties or disputes.

After consent to the respective category, Google Analytics receives technical/browsing/commerce data for analytics. Meta Pixel receives technical data, provider-processed IP, cookie identifiers, pages, product IDs and actions including product view, add-to-cart and checkout start, for advertising measurement/optimisation. Meta may associate data with other information under its notices. This installation does not transmit emails, phone numbers, customer lists, AI Fit data or advanced matching, and has no Conversions API path. Automatic Meta form/click inference is disabled. Starting preview checkout is not a paid Purchase event.

Only authorised staff and necessary providers may access data for hosting, Lovable Cloud, WooCommerce, support and, when active, shipping, payments and email sending. Google/Meta receive permitted events and may have independent roles for some purposes. Provider roles and agreements must be verified rather than calling every recipient a processor. The store’s possession of customer data does not authorise selling lists.

The company is in the UAE and providers may process in other countries. The UAE is not described as automatically GDPR-adequate. Chapter V transfers need an actually applicable mechanism, such as appropriate standard contractual clauses, assessments and necessary supplementary safeguards, or another valid instrument. Notice wording does not create these agreements. Provider locations, contracts and safeguards remain to be validated before sales. UAE overseas-transfer requirements apply separately.

Retain data only as necessary for purposes and applicable duties, not indefinitely for advertising. Account/wishlist data follows service duration and deletion requests, subject to lawful exceptions. Commercial records follow actual tax, warranty and legal-defence periods, which must be documented; a uniform ten-year term is not invented. Cookie choices/history are currently local and disappear when browser data is cleared. Operational schedules for commercial records, backups and logs must be confirmed and implemented.

You may request access, rectification, erasure, restriction, portability where applicable, and object to legitimate-interest processing and direct marketing. Consent may be withdrawn without affecting prior lawful processing. Email info@giovenza.com. GDPR requests normally receive a response within one month, with a reasoned statutory extension where applicable. Identity checks must be proportionate. You may complain to your competent EU supervisory authority and seek judicial remedies.

UAE rights include information/access, correction, erasure, restriction, objection and consent withdrawal where applicable. Current implementing mechanisms/deadlines require verification; GDPR’s one-month rule is not assigned to every UAE request. An Article 27 EU representative, where required, and any required DPO must be identified before sales, not invented here. The shop does not target children with advertising and must not send under-13 data to Meta. Age checks should be proportionate.

Apply risk-appropriate access/security controls; absolute security is not promised. Breaches are handled under applicable notification duties. No legally significant AI Fit automated decision is enabled. New purposes require notice, assessment and a lawful basis before processing. Cookie refusal does not prevent browsing or consumer requests. This notice states current operations and outstanding verification, not certification of unverified contracts.