Privacy Policy

1. Data Controller

The controller of the personal data collected through this site is Not For Resale LLC, a limited liability company with registered office at 8 The Green, STE R, Dover, DE 19901, USA (EIN: 61-2235642). The service is operated in collaboration with Shopify Inc. for the secure management of transactions.

This privacy policy describes how personal data is collected, used, and disclosed when you visit, purchase from, or communicate with us.

2. Personal data collected

We collect the following categories of personal data:

• Contact data — first name, last name, billing and shipping address, phone number, email
• Financial data — payment card details, bank details, transaction information
• Account data — username, encrypted password, preferences
• Transaction data — items viewed, cart content, orders, returns, purchase history
• Communications — messages, emails, support tickets, complaints
• Device data — browser, IP address, unique identifiers, network
• Usage data — pages visited, interactions, browsing behavior

3. Sources of data

Personal data may be collected:

• Directly from the user when creating an account, placing an order, or contacting us
• Automatically via cookies, logs, and tracking technologies (see Cookie Policy)
• From service providers (payments, shipping, analytics, marketing)
• From partners when the user authorizes connections with apps or integrations

4. Purposes of processing

Your data is processed to:

• Manage orders, shipments, returns, and customer service
• Personalize the shopping experience and provide recommendations
• Send commercial communications only with prior consent (newsletters, offers)
• Prevent fraud, verify identity, and protect the site from illicit activities
• Comply with legal and regulatory obligations
• Improve the site through aggregate analysis (Google Analytics, Meta Pixel)

5. Legal basis

Data processing takes place on the following legal bases:

• Contract performance for fulfilling orders
• Explicit consent for marketing, newsletters, and non-technical cookies
• Legitimate interest for analytics, fraud prevention, and service improvement
• Legal obligation for billing, tax records, and regulatory compliance

6. Data sharing

Data may be shared with third parties in compliance with current legislation:

• Shopify Inc. — e-commerce platform and data management
• Shopify Payments / PayPal — PCI-DSS certified payment processors
• Couriers (BRT, UPS, etc.) for shipments
• Meta / Google for analytics and advertising
• Technical providers (hosting, email, CRM)
• Competent authorities when required by law

7. Data transfer outside the EU

Some providers may be based in third countries (e.g., USA). Transfers take place through mechanisms approved by the European Commission: Standard Contractual Clauses (SCCs) or, where applicable, the Data Privacy Framework.

8. Retention period

Data is retained for the time strictly necessary for the purposes of processing:

• Order and billing data — 10 years (tax obligation)
• Account data — until deletion requested by the user
• Marketing data — until consent is withdrawn
• Browsing logs — maximum 12 months

9. Security

We adopt appropriate technical and organizational measures to protect your data: 256-bit SSL encryption on all connections, 3D Secure payments, restricted access to sensitive data, and constant monitoring against unauthorized access.

10. Your rights

In accordance with the GDPR, you have the right to:

• Access — obtain a copy of the personal data we process
• Rectification — correct inaccurate or incomplete data
• Erasure ("right to be forgotten") — request the deletion of data
• Restriction — limit processing in certain circumstances
• Portability — receive data in a structured format to transfer elsewhere
• Objection — object to processing for marketing or legitimate interest
• Withdraw consent — at any time, without affecting the lawfulness of previous processing

To exercise these rights, write to info@notforresale.it. We will respond within 30 days.

11. Minors

The service is not intended for children under 16 years of age. We do not knowingly collect personal data from minors. If you become aware that a minor has provided us with data, please contact us for immediate deletion.

12. Complaints

If you believe that processing violates the law, you may lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) or the competent supervisory authority for your country of residence.

13. Policy changes

We reserve the right to update this policy. Changes will be published on this page and, if substantial, communicated via email to registered users.