Privacy policy

Last Updated: October 18, 2026

This Privacy Policy explains how Camistry collects, uses, shares and protects personal data when you visit www.camistry.eu (the "Site"), place an order, sell equipment to us, or otherwise contact or interact with us (together, the "Services"). It is provided in accordance with the EU General Data Protection Regulation 2016/679 ("GDPR"), the Italian Personal Data Protection Code (Legislative Decree 196/2003, as amended), the UK GDPR, the Swiss Federal Act on Data Protection ("FADP") and other applicable data protection laws.

For any question about this policy or to exercise your rights, please contact us:

• Email: info@camistry.eu

• WhatsApp Hotline: +39 3508815650

---

 

1. Who We Are (Data Controller)

The data controller is Matteo Montemarani, sole proprietorship trading as Camistry / www.camistry.eu, Via Sant'Andrea 4/D, 56029 Santa Croce sull'Arno (PI), Italy – VAT No. IT02501320507 – REA PI-259563 – Email: info@camistry.eu.

We have not appointed a Data Protection Officer, as this is not required for our activities. Where applicable law requires us to designate a representative in the United Kingdom or Switzerland, the representative's details will be published in this section.

 

2. Scope of This Policy

This policy applies to personal data processed through the Site, by email, through WhatsApp, through our contact, newsletter and withdrawal forms, through our social media accounts, and in connection with orders placed with us through third-party marketplaces (such as eBay) to the extent that we receive and process your data as an independent controller. Marketplaces, payment providers and social networks process your data under their own privacy policies, for which we are not responsible.

This policy is an information notice. It does not ask for your consent: where consent is required (for example, for marketing cookies or the newsletter), we ask for it separately.

 

3. Personal Data We Collect

We only collect the data we need for the purposes described in Section 4. Depending on how you interact with us, this may include:

• Identity and Contact Data: name, billing and shipping address, email address, phone number, and, for business customers, company name and VAT number.

• Order and Transaction Data: products purchased, prices, order and invoice numbers, payment method, payment status and confirmation, transaction identifiers, shipping and tracking information, and customs documentation. We never receive or store your full card number: card details are handled directly by our PCI-DSS compliant payment providers.

• Account Data: login email, encrypted password and account preferences, if you create an account.

• Communications Data: the content of your emails, WhatsApp messages, contact form submissions and social media messages, including photos, videos and documents you send us (for example, for warranty, damage or return claims).

• Withdrawal, Return and Warranty Data: order number, items concerned, withdrawal statement, optional reasons, condition reports and photographic evidence.

• Seller Data (if you sell equipment to us): identity and contact data, identity document details where required by law, bank details for payment, information on the item and its origin, and the related purchase documentation.

• Verification and Fraud-Prevention Data: IP address, approximate location, device and browser information, consistency between billing, shipping and payment data, fraud-risk indicators provided by Shopify and our payment providers, order and dispute history and, where we request it for a high-value or flagged order, proof of identity or proof of address.

• Shipment Documentation Data: video recordings of the packing process, photographs of items before dispatch, and certified package weights. These records show the shipping label and therefore your name and delivery address (see Section 6).

• Technical and Usage Data: IP address, browser type, device identifiers, pages viewed, products viewed or added to cart, referring pages and interaction data collected through cookies and similar technologies (see Section 8).

• Marketing Data: your newsletter subscription status, your communication preferences and, where permitted, whether you open or click our emails.

We do not request, and ask you not to send us, special categories of personal data (such as data about health, political opinions or religious beliefs). If you send such data spontaneously, we will delete it unless it is strictly necessary to handle your request.

Providing the data marked as required at checkout or in our forms is necessary to conclude and perform the contract or to handle your request. If you do not provide it, we will be unable to process your order or request.

 

4. How We Use Your Data and Legal Bases

• Processing and delivering orders, payments, withdrawals, returns, refunds, repairs and warranty claims, managing your account, and providing customer support. Legal basis: performance of a contract or pre-contractual steps taken at your request (Art. 6(1)(b) GDPR).

• Purchasing equipment from you, if you sell gear to us. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and legal obligations (Art. 6(1)(c) GDPR).

• Complying with legal obligations, including tax, accounting, electronic invoicing, VAT (including the EU One-Stop-Shop scheme), customs and record-keeping obligations, consumer law obligations, and lawful requests from public authorities. Legal basis: legal obligation (Art. 6(1)(c) GDPR).

• Preventing fraud and abuse, verifying orders, securing payments, and protecting the Site (see Section 5). Legal basis: our legitimate interest in preventing fraud and ensuring network and information security (Art. 6(1)(f) GDPR and Recitals 47 and 49).

• Establishing, exercising or defending legal claims, including chargebacks, payment disputes, marketplace cases, carrier and insurance claims, and judicial or out-of-court proceedings. Legal basis: our legitimate interest in protecting our rights (Art. 6(1)(f) GDPR).

• Documenting the contents and condition of shipments (see Section 6). Legal basis: our legitimate interest in proving the correct fulfilment of orders (Art. 6(1)(f) GDPR).

• Sending service communications about your orders, account, shipments, returns and this policy. Legal basis: performance of a contract and legal obligation. These messages are not marketing and cannot be opted out of while an order or account is active.

• Sending marketing emails about products similar to those you purchased. Legal basis: our legitimate interest under Art. 130(4) of the Italian Privacy Code ("soft opt-in"), subject to your right to object at any time (see Section 7).

• Sending our newsletter and other marketing communications, and showing personalised advertising and measuring its effectiveness through non-essential cookies. Legal basis: your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time.

• Analysing and improving the Site and our Services. Legal basis: your consent where non-essential cookies are used; otherwise our legitimate interest in using aggregated or pseudonymised statistics.

• Business transfers, such as the sale, transfer or reorganisation of all or part of our business. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).

Where we rely on legitimate interest, we have assessed that our interests are not overridden by your rights and freedoms. You can request more information on this assessment by contacting us.

 

5. Fraud Prevention, Order Verification and Dispute Defence

Because we sell high-value equipment worldwide, we screen orders for fraud. Shopify and our payment providers automatically assign risk indicators to transactions. These indicators are used to flag orders for review; any decision to cancel or suspend an order is taken by a person, not solely by automated means.

For high-value orders, orders flagged as risky, or orders with inconsistent billing, shipping or payment data, we may:

• ask you for additional information, proof of identity or proof of address, using only official channels;

• delay shipment until verification is complete, or require shipment to the verified billing address;

• cancel the order and refund the amount paid if verification is not provided or is not satisfactory.

When you send an identity document, you may mask any data not needed for verification (such as the document number or photo, where we indicate this). Verification documents are kept only for as long as necessary for the verification and for any related dispute.

In the event of a chargeback, payment dispute, marketplace case or legal claim, we may share relevant order data, communications, tracking information, delivery confirmations and shipment documentation (including packing recordings and weight records) with payment providers, card issuers, banks, marketplaces, carriers, insurers, legal advisors, courts and authorities, to the extent necessary to defend our rights.

Data relating to confirmed or reasonably suspected fraud, abuse or unjustified chargebacks may be retained to prevent repeated abuse, and we may refuse future orders from the persons concerned.

 

6. Shipment Documentation (CCTV Packing Records)

To ensure accuracy and transparency, our packing process is recorded by an internal CCTV system and each package is weighed on certified scales before being handed to the courier. The cameras frame only the packing area and the items being packed. The recordings may show the shipping label and therefore the recipient's name and address.

Recordings are stored securely, accessed only by us, and used exclusively to document the contents and condition of shipments and to handle claims, disputes and chargebacks. They are kept for 24 months from dispatch, which covers the dispute periods of card networks and marketplaces, or longer if a claim or dispute is pending, until it is finally resolved.

 

7. Marketing Communications

• Newsletter: we send our newsletter only if you subscribe. You can unsubscribe at any time using the link in every email or by contacting us.

• Existing customers: we may use the email address you provided when purchasing to send you information about products similar to those you bought, without asking for your consent, as permitted by Art. 130(4) of the Italian Privacy Code. You can object at the time of purchase and at any time afterwards via the unsubscribe link in each email.

• We do not send marketing by SMS, WhatsApp or telephone without your prior consent.

Unsubscribing from marketing does not affect service communications about your orders.

 

8. Cookies and Similar Technologies

We use cookies, pixels and similar technologies ("Cookies") on the Site, divided into the following categories:

• Strictly necessary Cookies: required for the Site to function (shopping cart, checkout, login, security, fraud prevention, storing your cookie choices). They do not require consent and cannot be disabled.

• Preference Cookies: remember choices such as country, currency and language.

• Analytics Cookies: help us understand how the Site is used.

• Marketing Cookies: used by us and our advertising partners to show you relevant ads on other websites and to measure their effectiveness.

Non-essential Cookies are used only with your consent, given through our cookie banner. Closing the banner or continuing to browse does not count as consent. You can change or withdraw your consent at any time through the cookie preferences link on the Site, and by adjusting your browser settings. Where required by applicable law, we treat the Global Privacy Control (GPC) signal as a valid opt-out request.

Third parties that may set Cookies on the Site, depending on your choices, include Shopify, Google (Analytics, Ads and Merchant Center, including Google Consent Mode), Meta (Instagram) and TikTok. Each acts under its own privacy policy. For information about the Cookies used by our store platform, see https://www.shopify.com/legal/cookies.

If we use Shopify's advertising services (such as Shopify Audiences), you can limit the use of your data for these services at https://privacy.shopify.com/en.

 

9. Who We Share Your Data With

We share personal data only as necessary for the purposes described above, with:

• Service providers acting on our behalf (data processors), bound by data processing agreements: our e-commerce platform Shopify (Shopify International Limited, Ireland, and its affiliates), email and cloud service providers, IT and website maintenance providers, and our accountant and tax advisors.

• Payment providers, acting as independent controllers: Shopify Payments and its payment partners (including Stripe), PayPal, Klarna, and wallet providers such as Apple Pay, Google Pay and Shop Pay. Providers such as Klarna may carry out their own identity and credit checks under their own privacy policies.

• Carriers and customs: couriers and postal operators (such as DHL, UPS, DPD and Poste Italiane), customs brokers and customs authorities, to deliver your order and complete customs formalities.

• Marketplaces and communication platforms, such as eBay (for orders placed there) and WhatsApp (Meta), when you choose to contact us through them.

• Advertising and analytics partners such as Google, Meta and TikTok, only on the basis of your cookie consent.

• Professional advisors and other third parties, such as lawyers, insurers, debt collection agencies, card issuers and banks, where necessary to defend our rights or handle claims and disputes (see Section 5).

• Public authorities, such as tax, customs, police and judicial authorities, where required by law.

• A buyer or successor in the event of a sale, transfer or reorganisation of our business.

We do not sell your personal data for money and do not disclose it to third parties for their own marketing purposes, except through advertising Cookies you have consented to.

 

10. International Data Transfers

Your data is mainly processed in the European Union. Some of our providers may process data in other countries, in particular the United Kingdom, Switzerland, Canada and the United States. In addition, when you order a delivery outside the EU, your shipping data is necessarily transferred to the carrier and customs authorities of the destination country.

Transfers outside the EU/EEA take place only:

• to countries recognised by the European Commission (or, for Swiss and UK data, by the competent Swiss or UK authorities) as providing an adequate level of protection, such as the United Kingdom, Switzerland, Canada and Japan;

• to recipients in the United States certified under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions);

• on the basis of Standard Contractual Clauses approved by the European Commission (and their UK and Swiss equivalents), with supplementary measures where needed; or

• where the transfer is necessary to perform the contract with you, for example to deliver an order to the country you chose (Art. 49(1)(b) GDPR).

You may request information on the safeguards used by contacting us.

 

11. Data Retention

We keep personal data only for as long as necessary for the purposes for which it was collected, in particular:

• Invoices, accounting and tax records: 10 years, as required by Italian law (Art. 2220 of the Italian Civil Code and tax legislation).

• Order, payment, shipping, withdrawal, return and warranty records and related communications: 10 years from the order, corresponding to the ordinary limitation period for contractual claims under Italian law.

• Seller data (equipment purchased from you): 10 years, as required by tax and record-keeping rules.

• Packing recordings: 24 months from dispatch (see Section 6).

• Data relating to fraud, abuse, chargebacks or disputes: until the matter is finally resolved and, to prevent repeated abuse, up to 10 years.

• Account data: until you close your account; order records are then kept as indicated above.

• Customer service enquiries not linked to an order: 24 months from the last contact.

• Newsletter and marketing data: until you unsubscribe or object.

• Cookies: for the duration indicated in our cookie banner; your cookie choices are stored for up to 12 months.

Retention may be extended where required by law or by order of an authority, or for the time needed to handle a pending claim or dispute. At the end of the retention period, data is deleted or irreversibly anonymised.

 

12. Your Rights (EU, EEA, UK and Switzerland)

Subject to the conditions and limits set by law, you have the right to:

• Access your personal data and receive a copy of it (Art. 15 GDPR);

• Rectify inaccurate or incomplete data (Art. 16 GDPR);

• Erase your data (Art. 17 GDPR);

• Restrict processing (Art. 18 GDPR);

• Data portability for data you provided to us that is processed by automated means on the basis of contract or consent (Art. 20 GDPR);

• Object to processing based on legitimate interest and, at any time and without justification, to direct marketing (Art. 21 GDPR);

• Withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal;

• Lodge a complaint with a supervisory authority: in Italy, the Garante per la protezione dei dati personali (www.garanteprivacy.it); in the UK, the Information Commissioner's Office (ICO); in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC); or the authority of the EU/EEA country where you live or work.

Limits to your rights. These rights are not absolute. In particular, we may refuse or limit a request where we must keep the data to comply with a legal obligation, or to establish, exercise or defend legal claims (for example, during a pending chargeback, payment dispute or marketplace case) (Art. 17(3) GDPR), or where we demonstrate compelling legitimate grounds that override your interests (Art. 21(1) GDPR). Exercising your rights does not suspend any pending contractual obligation, payment, claim or dispute.

How to exercise your rights. Send your request to info@camistry.eu, preferably from the email address associated with your order or account. To protect your data, we may ask you to verify your identity before acting on your request. We will respond within one month of receipt; this period may be extended by two further months for complex or numerous requests, in which case we will inform you. Requests are free of charge; however, where a request is manifestly unfounded or excessive, in particular because of its repetitive character, we may charge a reasonable fee or refuse to act on it (Art. 12(5) GDPR).

 

13. Additional Information for Residents of Other Countries

United States: depending on your state of residence (for example, California, Virginia, Colorado, Connecticut or Texas), and where those laws apply to us, you may have the right to know what personal information we collect and how we use and disclose it, to access, correct and delete it, and to opt out of targeted advertising and of the "sale" or "sharing" of personal information as defined by those laws. We do not sell personal information for money. The only disclosures that may qualify as "sale", "sharing" or targeted advertising under some state laws are those made through advertising Cookies, which you can disable through the cookie preferences link on the Site or by enabling the Global Privacy Control signal. We do not use or disclose sensitive personal information to infer characteristics about you, and we do not knowingly sell or share personal information of persons under 16. You may designate an authorised agent, who must provide proof of your authorisation; we may also ask you to verify your identity directly. If we deny your request, you may appeal by replying to our decision; if your appeal is denied, you may contact your state Attorney General. We will not discriminate against you for exercising your rights.

Canada, Australia, Brazil, Japan and other countries: if you live in a country whose laws grant you rights over your personal data (such as PIPEDA in Canada, the Privacy Act in Australia, the LGPD in Brazil or the APPI in Japan), you may exercise those rights by contacting us as described in Section 12. Your data may be processed in the European Union and in the other countries indicated in Section 10.

 

14. Data Security

We apply appropriate technical and organisational measures to protect your data, including encrypted connections (HTTPS/TLS), PCI-DSS compliant payment processing, access restricted to authorised persons, two-factor authentication on our business accounts, and secure storage of shipment recordings. In the event of a personal data breach, we will notify the competent authority and, where required, the persons concerned, in accordance with Articles 33 and 34 GDPR.

No method of transmission or storage is completely secure. To the extent permitted by law, we are not liable for unauthorised access caused by events beyond our reasonable control. You are responsible for keeping your account credentials confidential and should contact us immediately if you suspect unauthorised use of your account. Please do not send payment card details or other sensitive information through email, WhatsApp or social media.

 

15. Children

The Services are intended for adults. Purchases may only be made by persons who have reached the age of majority in their country of residence. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us and we will delete it, except where retention is required by law.

 

16. Third-Party Platforms, Links and User Content

The Site contains links to third-party websites and platforms (such as Instagram, TikTok, eBay, payment providers and carriers' tracking pages). These operate under their own privacy policies, and we are not responsible for their content or practices. When you interact with us on social networks or marketplaces, those platforms may collect data about you independently.

Any reviews, comments or other content you publish on public areas of the Services or on third-party platforms may be visible to anyone. We are not responsible for the use that others make of information you choose to make public.

 

17. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices, services or applicable law. The updated version will be published on this page with a new "Last Updated" date, and it applies from the date of publication. Where changes are material and the law requires it, we will inform you by email or by a notice on the Site and, where necessary, ask for your consent.

 

18. Complaints and Contact

If you have a concern about how we handle your personal data, please contact us first so that we can try to resolve it:

• Email: info@camistry.eu

• Post: Camistry – Matteo Montemarani, Via Sant'Andrea 4/D, 56029 Santa Croce sull'Arno (PI), Italy

You also have the right to lodge a complaint with a supervisory authority at any time, as described in Section 12.

For the purposes of applicable data protection laws, Matteo Montemarani (Camistry) is the data controller of your personal data.