Last updated: 27 October 2026.
Here I explain what data I collect when you use this site or buy from me, why I use it, how long I keep it and what your rights are (articles 13 and 14 of EU Regulation 2016/679, «GDPR»).
Who the data controller is
The data controller is Salmastra Swimwear di Carlotta Duranti (sole proprietorship), Via Guerrazzi 20A, 57023 Cecina (LI), Italy, VAT no. 02099830495, REA LI-237201. For any question about your data: email info@salmastra.it, certified email (PEC) carlottaduranti@pec.it, WhatsApp +39 393 3372950.
What data and why
- Orders: name, addresses, email, phone, products purchased, any invoicing details. They’re needed to handle the order, shipping, payment and returns (performance of the contract) and to meet tax and accounting obligations (legal obligation).
- Account, if you create one: email and password, saved addresses and order history, so you can find everything again (performance of the contract).
- Gift card: if you give it as a gift, the name and email of the person receiving it and the message you write to them, which you give me only so I can send them the gift card (performance of the contract).
- Messages: what you write to me by email, WhatsApp, Instagram or through the forms on the site (for example the one for shops or the made-to-measure form), to reply to you and, if you ask, to prepare a quote (pre-contractual measures or legitimate interest in replying).
- Statistics: I count visits with Koko Analytics, anonymously and in aggregate, without cookies and without passing data to third parties (legitimate interest in understanding which pages work).
- Technical data: the server logs IP address, date and requested page for the security and operation of the site (legitimate interest).
The data marked as required at checkout is needed to ship and invoice: without it I can’t complete the order. Everything else is optional.
Who receives the data
I don’t sell or hand over your data. It’s seen only by the providers needed to run the shop, each for their own part:
- OVH, which hosts the site on a server in Zurich, Switzerland;
- couriers and Poste Italiane, also through the Paccofacile platform, to deliver the package;
- PayPal, which handles the payment as an independent controller under its own privacy policy;
- the bank, for bank transfers;
- the accountant, for bookkeeping;
- the person who does the technical maintenance of the site for me, Eugenio Miccoli, who for this can see the shop’s data and keeps the backups, and uses them for nothing else;
- Aruba, which provides the salmastra.it domain and the email inboxes where I receive your messages and order notifications;
- Meta (WhatsApp and Instagram), only if you choose to write to me there: their privacy policy applies.
The site is hosted in Switzerland, which the European Commission recognizes as a country with adequate data protection: data can go there without further safeguards. Some of the other providers may process data outside the European Union (for example in the United States): in that case the transfer is covered by the EU-US Data Privacy Framework or by the standard contractual clauses approved by the European Commission.
How long I keep it
- Orders and invoices: 10 years, as the law requires for accounting records;
- account: until you close it (you can ask me at any time; orders are kept for the period stated above);
- messages and requests without an order: 24 months;
- server technical logs: 7 days;
- backups: 7 days on the server; outside the server, 60 days for the database and the current and previous month for photos and site files.
Your rights
You can ask me at any time to see your data, correct it, delete it, restrict its use, or receive it in a readable format to take it elsewhere, and you can object to processing based on legitimate interest. If you gave me your consent, you can withdraw it whenever you like, without affecting what was done before. Just write to me at info@salmastra.it. If you think your data is being mishandled, you can file a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it).
Cookies
This site only uses technical cookies, needed for it to work: they remember the cart and the checkout session (WooCommerce) and, if you have an account, your login. The WhatsApp button counts the pages you visit to decide when to show its message: the count stays in the browser tab and disappears when you close it. None of this is used to profile you, which is why I don’t ask for your consent. The statistics don’t use cookies. You can delete or block cookies in your browser settings, but the cart might not work.
On the checkout page, and only there, the site loads PayPal’s tools for the PayPal button and the card fields. PayPal also uses them for the fraud checks that payment law requires of it: to run them, it reads some information about your device and saves the __paypal_storage__ item in your browser. They’re needed for the payment you’re making, so I don’t ask for your consent for these either. PayPal processes this data as an independent controller: the details are in its privacy and cookie statement on the PayPal website. On every other page, the site sends nothing to PayPal or to any other site.
Minors
You must be at least 18 to buy on this site.
Changes
If anything on this page changes, I update the date at the top.