Privacy Policy

Last updated: 30/07/2026

1. Data Controller

The controller of personal data is:

Maria Alberta Iaia
Owner of the sole proprietorship MUSHA MURRON ENTERPRISE
Registered office: Strada di Follettino, 58 – 00063 Campagnano di Roma (RM) – Italy
VAT number: IT17826021002 – Italian tax code: IAIMLB93H56A468U
Privacy contact email: support@handcrafted-heroes.com

No Data Protection Officer (DPO) has been appointed.

2. Scope

This notice describes the processing of personal data of users and Customers who:

browse the Website www.handcraftedheroes.it;
purchase products;
register an account;
subscribe to the newsletter;
complete contact forms or leave reviews.

This notice applies only to the Controller’s Website and does not extend to third-party websites or services accessed through links or integrations.

3. Categories of Data Subjects

Consumers (natural persons) who purchase or browse the Website for personal purposes;
Business customers / shops purchasing for resale purposes (with a VAT number);
Users subscribed to the newsletter;
Users who send enquiries through contact forms or request support;
Website visitors (including unregistered visitors).

4. Minors

Purchases on the Website are also permitted for minors, provided that:

where required by law, purchases must be made with the consent and under the responsibility of a parent or legal guardian;
minors’ data, where collected, will be processed with particular care and in accordance with applicable legal requirements.

The Controller does not carry out profiling specifically targeting minors.

5. Types of Data Processed

Depending on interactions with the Website, the following may be collected:

Identity and contact data: first name, surname, shipping and billing addresses, email, telephone number (if provided), business details for Business Customers (business name, VAT number and address).
Order data: purchased products, amounts, payment methods (without storing complete payment card details), delivery address and notes entered by the Customer.
Account data (if created): username, password (in encrypted form) and order history.
Browsing and technical data: IP address, device identifiers, browser type and operating system, Website access logs and security activities (e.g. reCAPTCHA).
Newsletter and marketing data: email address, preferences and interactions with campaigns (opens, clicks, etc.).
Enquiry and communication data: contents of messages sent through forms or email and support tickets.
Review data: name or nickname, review content and ratings.
Data collected through cookies and similar technologies, as described in the Cookie Policy.

6. Processing, Purposes, Legal Bases and Retention

The main processing purposes are summarised below.

6.1 Website Browsing and Security

Data categories: browsing data, technical logs, IP address and data associated with reCAPTCHA and similar systems.
Purposes: enable browsing of the Website; ensure Website security and prevent abuse, fraud and unauthorised access.
Legal basis: the Controller’s legitimate interest in the secure operation of the Website.
Retention period: technical and security logs retained for 14 months (subject to additional requirements in the event of security incidents).
Recipients: hosting provider (Hostinger), security providers (e.g. Google reCAPTCHA) and persons authorised by the Controller.
Whether provision is mandatory: necessary for browsing and security; otherwise the Website cannot be used correctly.

6.2 Creating and Managing User Accounts

Data categories: identity data, addresses, email, login credentials (encrypted password) and order history.
Purposes: enable account creation; allow users to view orders and shipping/billing details; facilitate subsequent orders.
Legal basis: performance of pre-contractual measures and the sales contract at the data subject’s request.
Retention period: up to 14 months after the last significant account activity or until a deletion request, without prejudice to further retention of data necessary for accounting/tax purposes.
Recipients: providers and technicians managing the e-commerce platform (WooCommerce, Hostinger).
Whether provision is mandatory: optional; Customers may also purchase as “guests” without creating an account.

6.3 Managing Orders, Payments and Invoicing

Data categories: identity and contact data, shipping and billing addresses, order data, payment details (limited to transaction outcome/ID) and tax data (Italian tax code, VAT number).
Purposes: receive and manage orders; process payments; issue invoices on request; arrange shipping and delivery; handle returns, refunds, complaints and statutory guarantees; comply with tax and accounting obligations.
Legal basis: performance of the sales contract; compliance with legal obligations (particularly tax and accounting obligations).
Retention period: order and invoicing data: 4 years (or any longer period required by applicable tax law); returns and complaints data: as long as necessary to handle the complaint and for the limitation period of the related rights.
Recipients: payment providers (PayPal, WooCommerce Payments, Klarna, Satispay, Apple Pay/Google Pay through PSPs); credit institutions; tax/accounting advisers (where appointed); carriers and freight forwarders (Poste Italiane, SDA, DHL, UPS).
Whether provision is mandatory: necessary to conclude the sales contract; failure to provide the data prevents completion of the order.

6.4 Shipping and Product Delivery

Data categories: first name, surname, shipping address, telephone number (if provided), email and order number.
Purposes: arrange shipping and delivery; provide the carrier with the data necessary to carry out the shipment; send tracking updates (where provided).
Legal basis: performance of the sales contract.
Retention period: in line with order data (see above).
Recipients: appointed carriers and logistics service providers.
Whether provision is mandatory: necessary to receive the purchased products.

6.5 Customer Support, Returns and Complaints

Data categories: contact data (email and any telephone number), enquiry content and order/product data.
Purposes: handle information requests, after-sales support, exercise of the right of withdrawal, returns and statutory guarantees; resolve complaints or disputes; improve the service.
Legal basis: performance of the contract or pre-contractual measures; the Controller’s legitimate interest in providing support and protecting its rights.
Retention period: as long as necessary to handle the request and, where linked to a contract, for the limitation period of the related rights.
Recipients: internal staff and/or collaborators assigned to support.
Whether provision is mandatory: the requested data is necessary to respond to enquiries.

6.6 Newsletters and Commercial Communications

Data categories: email, name (if provided), preferences and campaign interaction data (opens, clicks, etc.).
Purposes: send periodic newsletters with information, product news, promotions and special offers; carry out marketing campaigns based on subscriber lists.
Legal basis: consent expressly given by the data subject through registration using double opt-in (Mailchimp).
Retention period: until consent is withdrawn / the user unsubscribes from the newsletter; thereafter, only as long as strictly necessary to process the opt-out request.
Recipients: email marketing service provider (Mailchimp) and persons authorised by the Controller.
Whether provision is mandatory: optional; failure to provide the data prevents receipt of newsletters but does not affect purchases.

6.7 Marketing Automation and Abandoned Cart Recovery

Data categories: email, cart-related browsing data, products added but not purchased and marketing preferences (where available).
Purposes: send automated communications (e.g. welcome, post-purchase and abandoned cart reminders) to users who have given appropriate consent or qualify as existing Customers under the law; optimise the shopping experience and commercial communications.
Legal basis: the data subject’s consent for personalised marketing and automation; possible legitimate interest (where permitted) for communications with existing Customers about similar products, subject to applicable legal conditions.
Retention period: in line with marketing data management; deletion or anonymisation after a reasonable period of inactivity or withdrawal of consent.
Recipients: marketing automation providers (e.g. Mailchimp, WooCommerce and marketing plugins) and authorised persons.
Whether provision is mandatory: optional.

6.8 Profiling, Remarketing and Targeted Advertising

Data categories: browsing data, interactions with the Website and newsletters, and data collected through advertising and profiling cookies (Meta Pixel, Google Ads, TikTok, etc.).
Purposes: create audience segments to display targeted advertisements on third-party platforms; analyse advertising campaign performance; offer content and promotions more closely aligned with expressed interests.
Legal basis: consent through the cookie banner for marketing and profiling cookies.
Retention period: according to cookie lifetimes and provider settings (generally up to 12/24 months), unless consent is withdrawn earlier.
Recipients: advertising and social media service providers (Meta, Google, TikTok, etc.).
Whether provision is mandatory: optional; withholding consent does not affect the ability to use the Website or make purchases.

6.9 Reviews (Trustpilot)

Data categories: name or nickname, review content, rating, contact details (if required by the platform) and order reference.
Purposes: collect Customer feedback; publish reviews and ratings on the Website or third-party platforms; improve products and services.
Legal basis: the data subject’s consent (where a review is voluntarily submitted); the Controller’s legitimate interest in promoting and improving its services, respecting the review author’s freedom of expression.
Retention period: for the lifetime of the product/service or until removal is requested, where applicable under the platform’s policies.
Recipients: review platform Trustpilot and users who view the reviews.
Whether provision is mandatory: optional.

6.10 Statistics, Aggregate Analysis and Website Improvement

Data categories: browsing data, data supplied by analytics tools (GA4) and aggregate information on Website use.
Purposes: analyse Website use; improve structure, content and usability; plan developments and optimisations.
Legal basis: user consent for non-anonymised analytics cookies; the Controller’s legitimate interest in developing the service where aggregate/anonymised data is used.
Retention period: according to analytics tool settings (e.g. GA4) and in any case limited to what is necessary for the purposes stated above.
Recipients: analytics providers (Google) and authorised persons.
Whether provision is mandatory: optional; withholding consent to analytics cookies may reduce the completeness of statistics but does not affect Website use.

6.11 Establishing and Defending Legal Claims

Data categories: all data necessary for these purposes, including order data, communications, logs, etc.
Purposes: establish, exercise or defend rights in judicial or pre-litigation proceedings; manage disputes, objections and debt collection.
Legal basis: the Controller’s legitimate interest in protecting its rights.
Retention period: as long as necessary to defend rights, in accordance with applicable limitation periods.
Recipients: legal advisers, judicial and administrative authorities and law enforcement.
Whether provision is mandatory: necessary in the event of actual or potential litigation.

7. Cookies and Similar Technologies

For details of cookies used by the Website, their purposes, legal bases, lifetimes and consent management, please refer to the EU Cookie Policy published on the Website.

8. Processing Methods

Personal data is processed:

using electronic tools and, where necessary, paper records;
in ways strictly related to the stated purposes;
with appropriate technical and organisational measures to ensure data security, confidentiality and integrity.

The Controller does not carry out fully automated decision-making producing legal effects concerning the data subject or similarly significantly affecting them, unless specifically stated otherwise and additional information is provided.

9. Data Recipients and Processors

Personal data may be disclosed to:

Technical and IT service providers: hosting (Hostinger), platform maintenance, developers and plugin operators (e.g. WooCommerce, Complianz).
Payment providers: PayPal, WooCommerce Payments, Klarna, Satispay, Apple Pay and Google Pay (through their respective PSPs).
Carriers and freight forwarders: Poste Italiane, SDA, DHL, UPS or others appointed.
Newsletter and marketing providers: Mailchimp, automation and CRM platforms, social media and advertising providers.
Review platforms: Trustpilot.
Professionals and advisers: tax, accounting and legal advisers, to the extent necessary to perform their respective assignments.
Competent authorities: public bodies, judicial authorities and law enforcement, where required by law or pursuant to orders and measures.

These parties act:

as data processors, under contractual agreements governing their tasks and responsibilities; or
as independent controllers, where they independently determine the purposes and means of processing (e.g. payment institutions and social platforms).

An up-to-date list of the main data processors may be requested from the Controller using the contact details provided.

10. Transfers Outside the EEA

As at the date of this notice, some service providers (e.g. Mailchimp, Google, Meta, TikTok and Trustpilot) may have offices or infrastructure outside the European Economic Area.

In such cases, data transfers take place, where applicable, on the basis of:

any adequacy decisions in place for the destination country;
or, in their absence, appropriate safeguards, such as standard contractual clauses and supplementary measures, as required by applicable law.

Further details may be requested from the Controller at the contact email address.

11. Data Subject Rights

Subject to the limits and conditions of applicable law, data subjects may exercise the following rights:

Access: obtain confirmation of whether their data is being processed and information on its origin, purposes, data categories, recipients and retention period.
Rectification: request correction or updating of inaccurate or incomplete data.
Erasure: obtain deletion of data when no longer necessary for the purposes, when consent is withdrawn (if no other legal basis exists) or when data is processed unlawfully.
Restriction: request that data be processed only for storage in the circumstances provided by law.
Portability: receive personal data supplied to the Controller in a structured, machine-readable format and transmit it to another controller, where technically possible and within legal limits.
Objection: object to processing based on legitimate interest on grounds relating to their particular situation, and at any time to processing for direct marketing, including profiling related to that marketing.
Withdrawal of consent: withdraw previously given consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

Requests may be sent to:

Email: support@handcrafted-heroes.com

Data subjects also have the right to lodge a complaint with the competent supervisory authority, as provided by applicable law.

12. Changes to this Notice

This Privacy Policy may be updated. In the event of substantial changes, the Controller may communicate them through the Website (e.g. a banner, an email or an updated date in the heading).

Users are invited to consult this page periodically.

Matters to Complete/Verify Internally

Detailed confirmation of providers outside the EEA and the related transfer safeguards;
Fine-tuning retention periods based on actual accounting/tax practices and current obligations;
Possible clarification of advanced profiling if more intrusive or automated tools are introduced in future.