Privacy Policy of www.elisalancishop.com
Last updated: [22/11/2025]
With this Privacy Policy, the data controller, as defined below, wishes to provide users and visitors to the website www.elisalancishop.com (“Site”) with all information relating to the purposes for which their personal data are collected and processed, the categories of personal data subject to processing, the rights granted to users and visitors to the Site under Regulation (EU) No. 679/2016 (“GDPR”) and national legislation on data protection (collectively, “Privacy Regulations”), and how users and visitors to the Site can exercise these rights. This Privacy Policy also aims to enable users and visitors to the Site to provide informed consent to the processing of their personal data, where required under the Privacy Regulations.
This document can be printed using the print command available in the settings of any browser.
1. Data Controller
LADY SHOES SRL, CORSO ATELLANO 51/53, 81030 SANT'ARPINO (CE) - IT, Italy, , email: lady-shoes@virgilio.it, is the data controller responsible for processing the data of users/visitors collected through the Site (“Data Controller” o “Elisalanci”).
Data Controller's email address: lady-shoes@virgilio.it
2. Types of Data Collected
The personal data of users/visitors that the Data Controller collects through the Site include:
- Personal details (first name, last name, company name, date of birth, tax code, VAT number);
- Contact details (email address, telephone number, physical shipping address, and billing address); and
- Any responses provided by users/visitors to the questions and feedback requested by the Site through online forms and surveys (hereinafter, “Personal Data”).
The Personal Data listed above are collected by the Site when:
- registration on the Site, for users registering on the Site for the first time (“User”); or
- the purchase of one or more of the products offered for sale through the Site, for users not registered on the Site (“Guest”).
Unless otherwise specified on the Site, all Personal Data requested are to be considered mandatory. Therefore, it is understood that failure to provide Personal Data marked as mandatory prevents registration on the Site or use of the services offered there; failure to provide Personal Data that may be marked as optional does not prevent registration on the Site or use of the services offered there, but may nevertheless make use of them less immediate and user friendly.
This Website also uses Cookies and/or other tracking tools in accordance with the methods and purposes described in the Cookie Policy (see art. 6 below).
The User/Guest assumes responsibility for the Personal Data of third parties that they have published or shared through this Website and guarantees that they have the right to communicate or disseminate it, and that they have informed said third parties of this Privacy Policy, releasing the Controller from any liability toward such third parties.
3. Purposes and Legal Bases for the Processing of Personal Data
Purposes of processing
The Users'/Guests' Personal Data will be processed by the Controller in accordance with the principles of necessity, data minimization, lawfulness, fairness, proportionality and transparency for the following purposes:
(a) to provide the Website, enable access to and registration on the Website, and enable use of the services offered through the Website, including the online purchase of products and order management, as well as any other service that may be offered in the future through the Website and requested by the User/Guest, and to improve the Website and the services offered therein;
(b) to provide the User/Guest with assistance (by completing the appropriate form available on the Website or contacting the Controller directly) during registration on and/or use of the Website and the services offered therein, and also to resolve any reports of malfunctions and/or disputes;
(c) to comply with legal obligations, respond to requests from the competent Authorities, protect its own rights and interests, and identify any malicious or fraudulent activities;
(d) to provide the User/Guest, via the email address provided when registering on the Website or making a purchase through the Website, with commercial information and newsletters concerning products and services similar to those already purchased/requested by the User/Guest;
(e) to send the User advertising material and carry out promotional, marketing and/or direct sales activities for products and/or services sold and/or provided by the Controller;
(f) to send the User commercial and promotional communications concerning selected third-party products and/or services (i.e. companies belonging to the Group to which the Controller belongs, parent, subsidiary and/or affiliated companies, companies that have agreements with the Controller and third-party partners), with which the Controller has legal relationships (without any Personal Data being communicated to third parties in this case);
(g) to carry out profiling activities concerning the Website User, that is, to assess their preferences, consumption habits and tastes, including by inviting them to participate in market research, for the subsequent sending of targeted marketing communications.
Legal basis for processing
The above-mentioned processing purposes (see the “Processing purposes” section, letters (a) to (g)) are processed by the Data Controller on the following legal bases:
(a) performance of the contract with the User/Guest and the Data Controller's legitimate interest;
(b) performance of the contract or pre-contractual measures at the User's/Guest's request and the Data Controller's legitimate interest
(c) compliance with a legal obligation to which the Data Controller is subject and/or the Data Controller's legitimate interest;
(d) the Data Controller's legitimate interest, unless the User/Guest objects;
(e) the User's express consent;
(f) the User's express consent; and
(g) the User's express consent.
With reference to the purpose referred to in point (d) above, the User/Guest may object at any time to receiving such communications by clicking the link at the bottom of the relevant email or by contacting the Data Controller at the email address indicated in Article 1 above.
The contact methods aimed at direct marketing activities, on behalf of third parties, and profiling as referred to in points (e), (f), and (g) above, they may be either automated (via email, SMS, push notifications, other mass messaging tools, etc.) or traditional (telephone calls with an operator and postal mailings). In any event, the User may withdraw their consent, including partially, for example by consenting only to traditional contact methods.
If the User consents to the profiling indicated in point (g) above, it will involve an automated activity aimed at placing the User in a category of individuals with homogeneous characteristics (in terms of purchasing preferences, products of interest, and purchasing areas) based on their previous purchasing experiences, any market analyses in which they may have participated, their demographic profile, and their activities on the Website.
Third-Party Websites and Applications
The User is reminded that the Website may incorporate or otherwise interact with applications and websites operated by third parties (“Third-Party Websites and Applications”), to make certain ancillary services offered through the Website available to Users/Guests. Third-Party Websites and Applications are governed by their respective terms and conditions of use and privacy policies. Users'/Guests' use of Third-Party Websites and Applications will therefore be governed by and subject to the terms and conditions of use and privacy policies of those third parties, to which reference is made.
4. Processing methods; Recipients of Personal Data; Location and retention period of Personal Data
Processing methods
The Data Controller adopts the appropriate security measures pursuant to Article 32 of the GDPR, aimed at preventing unauthorized access to, disclosure, alteration or destruction of Users’/Guests’ Personal Data.
Processing is carried out on paper and/or by means of IT and/or telematic tools, using organizational procedures and methods strictly related to the purposes indicated inArticle 3 above.
Recipients of Personal Data
The processing of Users’/Guests’ Personal Data will, for the individual operations, be entrusted to the Data Controller’s employees and/or collaborators (administrative, sales, marketing and legal staff, system administrators), duly authorized and appointed.
Any third parties appointed by the Data Controller to process Users’/Guests’ Personal Data (e.g. third-party technical service providers, postal couriers, hosting providers, IT companies, communication agencies) will be appointed as Data Processors pursuant to Article 28 of the GDPR. The updated list of Data Processors may always be requested from the Data Controller by contacting it at the email address indicated inart.1 above.
Users’/Guests’ Personal Data will not be disseminated or transferred outside the European Union.
Place and period of retention of Personal Data
Users’/Guests’ Personal Data will be stored on the Data Controller’s servers, all of which are located in the EU.
That said, Users/Guests are reminded that the Website may incorporate or otherwise interact with Third-Party Websites and Applications in order to make the ancillary services offered through the Website available. Third-Party Websites and Applications are governed by their respective terms and conditions of use and privacy policies. Users’/Guests’ use of Third-Party Websites and Applications will therefore be governed by and subject to those third parties’ terms and conditions of use and privacy policies, to which reference is made.
Users’/Guests’ Personal Data are processed by the Data Controller and retained for the time necessary for the purposes indicated inArticle 3 above. In particular:
- for the purposes referred to in points (a), (d), (e), (f) and (g) of Article 3 above, the Personal Data of Users will be retained by the Data Controller (but not used for purposes (d), (e), (f) and (g) in the event of objection, or if consent is not given or is subsequently withdrawn) until the User deletes their account. It is nevertheless understood that the Data Controller may retain Users’ Personal Data to defend its rights in relation to disputes pending at the time of the request or as directed by public authorities. The User may delete their account or send an express request to the Data Controller to delete the Personal Data (see Article 1 above);
- for the purpose referred to in point (a) of Article 3 above, the Personal Data of Guest will be retained until performance of the contract or existing pre-contractual measure has been completed. For the purpose referred to in point (d) of Article 3 above the Guests’ Personal Data will be retained, unless they object, for as long as the Controller’s legitimate interest continues. The Guests’ Personal Data will not, however, be processed - and therefore retained - for the purposes referred to in points (e), (f), and (g) of Article 3 above;
- for the purposes referred to in point (b) of Article 3 above, the Personal Data of Users/Guests will be retained for the time strictly necessary to resolve the request for assistance, report, and/or complaint and provide Users/Guests with a response. In this case as well, it is understood that the Controller may retain the Personal Data, within the limits permitted by law, to defend its rights in relation to ongoing disputes or at the request of public authorities; and
- for the purpose referred to in point (c) of Article 3 above, the Personal Data of Users/Guests will be retained by the Controller for as long as processing remains necessary to comply with those legal obligations.
At the end of the retention period, the Personal Data will be deleted. Therefore, once this period has expired, the rights of access, erasure, rectification, and data portability may no longer be exercised.
5. User/Guest Rights
Users/Guests may exercise certain rights with respect to the Personal Data processed by the Controller.
In particular, the User/Guest has the right to:
- obtain information regarding the purposes for which their Personal Data are processed, the processing period, and the parties to whom the Personal Data are disclosed (the so-called right of access);
- obtain the rectification or completion of inaccurate Personal Data concerning them (the so-called right to rectification);
- obtain the deletion of their Personal Data in the following cases (a) the Personal Data are no longer necessary for the purposes for which they were collected; (b) they have withdrawn their consent to the processing of the Personal Data where they are processed on the basis of their consent; (c) they have objected to the processing of their Personal Data where they are processed on the basis of the Controller’s legitimate interest; or (d) the processing of their Personal Data is unlawful (the so-called right to erasure). However, we inform the User/Guest that the Controller’s retention of their Personal Data is lawful where necessary to enable the Controller to comply with a legal obligation or to establish, exercise, or defend a right in legal proceedings;
- have the Personal Data concerning them merely stored, without being used for any other purpose, where (a) they contest the accuracy of their Personal Data, for the period necessary to enable us to verify the accuracy of such Personal Data; (b) the processing is unlawful but they nevertheless object to the deletion of their Personal Data by the Data Controller; (c) they require the Personal Data for the establishment, exercise or defense of a right in legal proceedings; (d) they have objected to the processing and are awaiting verification as to whether the Data Controller’s legitimate grounds for processing override those of the data subject (the so-called right to restriction);
- receive, in a commonly used, machine-readable and interoperable format, the Personal Data concerning them (the so-called right to data portability).
- obtain the cessation of processing where their Data are processed for commercial communications/newsletters concerning products or services identical to those already purchased/provided by the Data Controller (the so-called right to object); and
- withdraw their consent to the processing of Personal Data at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
How to exercise your rights
To exercise the rights listed above, Users/Guests may send a request to the Data Controller’s contact details indicated inart.1 above. Requests are submitted free of charge and processed by the Data Controller as quickly as possible. Finally, we remind you that the User/Guest has the right to contact the Italian Data Protection Authority, located at Piazza di Monte Citorio, 121 - 00186 Rome (RM), to assert their rights in relation to the processing of their Personal Data by the Data Controller.
6. Cookie Policy
This Website uses Cookies and other tracking tools. To learn more, the User/Guest may consult our Cookie Policy.
7. Changes to this Privacy Policy
Without prejudice to the fact that the Data Controller does not, under any circumstances, carry out processing operations other than those expressly authorized and/or requested by Users/Guests, this Privacy Policy may be amended to comply with new legal provisions, changes in the Data Controller’s policies for processing Personal Data, and/or changes to the features of the Website and/or the services offered on it. Each updated version of this Privacy Policy will be made available on the Website in the dedicated section. The Data Controller therefore invites Users/Guests to consult the Privacy Policy published on the Website periodically so that they are always informed of the latest version published.