Privacy Policy
Last update: August 16, 2026
This Privacy Policy explains what personal data we collect when you visit vibryz.com or make a purchase in our store, for what purposes we process it, who we may share it with, and what rights you may exercise. It is provided in accordance with Articles 13 and 14 of the EU Regulation 2016/679 (GDPR) and Legislative Decree 196/2003 (Privacy Code).
The use of cookies and tracking technologies is described in detail in the Cookie Policy, which is an integral part of this Privacy Policy.
1. Data Controller
Giuseppe Sanfilippo, sole proprietorship operating under the Vibryz brand
Via Cumiana 5, 10045 Piossasco (TO), Italy
VAT ID 12772030016
Email: info@vibryz.com
2. What data we process
- Personal and contact data: first and last name, shipping and billing address, email address, phone number.
- Tax data: tax code (codice fiscale) or VAT ID, if you request an invoice.
- Order data: products purchased, amounts, order date, shipping status, returns, and refunds.
- Payment data: full card numbers do not pass through our systems and are not stored by us. They are processed directly by the payment service provider. We only receive the transaction result, the method used, and the last digits of the payment instrument.
- Account data: username, encrypted password, saved addresses, and preferences, if you choose to register.
- Browsing data: IP address, browser and device type, pages visited, referring site, identifiers associated with cookies.
- Content you send us: support messages, product reviews, newsletter subscription.
3. Purposes, legal bases, and retention periods
| Purpose | Legal basis | Retention |
|---|---|---|
| Order management: payment, preparation, shipping, delivery, returns, and refunds | Performance of a contract to which you are a party (art. 6.1.b GDPR) | For the duration of the relationship and for applicable warranty and statutory limitation periods |
| Tax, accounting, and billing obligations | Legal obligation (art. 6.1.c GDPR) | 10 years, pursuant to art. 2220 of the Civil Code |
| Customer account management | Performance of a contract (art. 6.1.b GDPR) | Until account deletion is requested |
| Customer support and responding to your requests | Performance of a contract or legitimate interest in responding (art. 6.1.b and 6.1.f GDPR) | 24 months from the closure of the request |
| Sending newsletters and promotional communications | Consent (art. 6.1.a GDPR) | Until consent is withdrawn or unsubscription from the list |
| Publishing product reviews | Consent (art. 6.1.a GDPR) | Until removal is requested |
| Site statistical analysis and personalized advertising | Consent provided via the cookie banner (art. 6.1.a GDPR) | According to the durations indicated in the Cookie Policy |
| Site security, fraud prevention, and the exercise or defense of legal claims | Legitimate interest (art. 6.1.f GDPR) | For the time strictly necessary and in any case no longer than statutory limitation periods |
Providing the data marked as mandatory in order forms is necessary to complete the purchase: without it, we cannot process your order. Providing data for newsletter and marketing purposes is optional and may be revoked at any time.
4. Confidentiality of your purchases
We sell adult items and are aware that data relating to your orders deserves special confidentiality. We do not intentionally process special categories of personal data as per art. 9 of the GDPR, and we do not use the products you purchase to derive information about your private sphere outside of the purposes indicated in point 3. Orders are shipped in anonymous packaging, without references to the contents, and access to order data is limited to those who must process it to fulfill the order.
5. Who we share your data with
Your data is not disseminated. It may be shared with the following categories of recipients, acting as data processors on our behalf or as independent controllers, each to the extent strictly necessary:
| Recipient | Why they receive the data |
|---|---|
| Shopify, the platform hosting the store | Operation of the site, cart, checkout, and customer accounts; storage of store data. |
| Supplier who prepares and ships orders on our behalf | Receives the name, address, and contact details necessary for delivery, along with the list of items to be shipped. |
| Couriers and shipping services | Delivery of the package and tracking communications. |
| Payment service providers and card networks | Execution and verification of payments, refund management, fraud prevention. |
| Email marketing platform | Sending newsletters and promotional communications, if you have provided consent. |
| Online analytics and advertising tool providers | Measurement of traffic and advertising campaigns, only with your consent to cookies. The list is in the Cookie Policy. |
| Review collection and publication service | Invitation to review and publication of the review on the site. |
| Tax, accounting, and legal consultants | Administrative obligations and protection of rights. |
| Public authorities and supervisory bodies | Only when required by a legal obligation or a legitimate request. |
You can request the updated list of data processors by writing to info@vibryz.com.
6. Cookies, analytics, and advertising
We use technical cookies necessary for the site to function and, subject to your consent, preference, analytics, and marketing cookies. You can express, modify, or revoke your choices at any time as described in the Cookie Policy.
If you reside in a jurisdiction that recognizes the right, you may also object to the sharing of your data for targeted advertising purposes from the page Your privacy choices.
7. Transfer of data outside the European Economic Area
Store data is hosted by Shopify on servers located in the European Union. Some of the providers indicated in point 5, particularly those for online analytics and advertising, are based or use infrastructure in the United States. In these cases, the transfer occurs based on the safeguards provided by Chapter V of the GDPR: European Commission adequacy decisions or standard contractual clauses, accompanied by supplementary measures where necessary. You can ask us for a copy of the safeguards adopted by writing to info@vibryz.com.
8. Data security
We adopt appropriate technical and organizational measures to protect your data: encrypted connection throughout the site, administrative panel access limited and protected by personal credentials, and reliance on providers that guarantee adequate security standards. However, no system can be considered absolutely secure: we invite you to carefully keep your account credentials and not disclose them to third parties.
9. Children's data
The site sells items reserved for an adult audience. The Services are not intended for children under 18, and we do not knowingly collect their personal data. If you believe that a minor has provided us with their data, please write to info@vibryz.com: we will delete it without delay.
10. Automated decision-making and profiling
We do not adopt entirely automated decision-making processes that produce legal effects concerning you or similarly significantly affect you. If you have consented to marketing cookies or the newsletter, your browsing and purchase data may be used to show you more relevant content and ads. You can object to this processing at any time by revoking your consent.
11. Your rights
At any time, you can exercise the rights provided by Articles 15 to 22 of the GDPR:
- Access: know what data we process and obtain a copy.
- Rectification: correct inaccurate data or complete it.
- Erasure: request the removal of data, within the limits of retention obligations required by law.
- Restriction: request that processing be suspended in certain cases.
- Portability: receive data in a machine-readable format or have it transmitted to another controller.
- Objection: object to processing based on legitimate interest and, in any case and without justification, to direct marketing.
- Withdrawal of consent: at any time, without affecting the lawfulness of processing carried out before the withdrawal.
To exercise your rights, write to info@vibryz.com. We will respond within one month of receiving your request, extendable by two months for particularly complex requests, of which we will notify you. We may need to ask you to verify your identity before fulfilling the request.
If you believe that the processing of your data violates the regulations, you have the right to lodge a complaint with the Garante per la protezione dei dati personali (www.garanteprivacy.it) or to take legal action.
12. Changes to this Privacy Policy
We may update this Privacy Policy to reflect changes in the services used, our organization, or applicable law. The updated version is published on this page with a new last-update date. In the event of substantial changes, we will notify you by appropriate means.
13. Contacts
For any questions regarding this Privacy Policy or the processing of your personal data:
Giuseppe Sanfilippo — Vibryz
Via Cumiana 5, 10045 Piossasco (TO), Italy
VAT ID 12772030016
Email: info@vibryz.com