Privacy policy

Last updated: 25 August 2026

This Privacy Policy explains what personal data we collect when you visit vibryz.com or shop in our store, the purposes for which we process it, to whom we may disclose it and which rights you can exercise. It is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree No. 196/2003.

The use of cookies and tracking technologies is described in detail in the Cookie Policy, which forms an integral part of this Privacy Policy.

1. Data controller

Giuseppe Sanfilippo, sole proprietorship trading under the Vibryz brand
Via Cumiana 5, 10045 Piossasco (TO), Italy
Partita IVA (IT) 12772030016
Email: info@vibryz.com

2. What data we process

Identification and contact data: first and last name, shipping and billing address, email address, phone number.
Tax data: tax code or VAT number, if you request an invoice.
Order data: products purchased, amounts, order date, shipping status, returns and refunds.
Payment data: full card numbers do not pass through our systems and are not stored by us. They are processed directly by the payment service provider. We only receive the outcome of the transaction, the payment method used and the last digits of the payment instrument.
Account data: username, encrypted password, saved addresses and preferences, if you choose to register.
Browsing data: IP address, browser and device type, pages visited, referring site, identifiers associated with cookies.
Content you send us: messages to customer support, product reviews, newsletter sign-up.

3. Purposes, legal bases and retention periods

Order management — payment, preparation, shipping, delivery, returns and refunds. Legal basis: performance of a contract to which you are a party (Art. 6(1)(b) GDPR). Retention: for the duration of the relationship and for the applicable warranty and limitation periods.
Tax, accounting and invoicing obligations — Legal basis: legal obligation (Art. 6(1)(c) GDPR). Retention: 10 years, pursuant to Article 2220 of the Italian Civil Code.
Customer account management — Legal basis: performance of a contract (Art. 6(1)(b) GDPR). Retention: until you request deletion of the account.
Customer support and responses to your requests — Legal basis: performance of a contract or legitimate interest in responding (Art. 6(1)(b) and 6(1)(f) GDPR). Retention: 24 months from the closure of the request.
Sending the newsletter and promotional communications — Legal basis: consent (Art. 6(1)(a) GDPR). Retention: until consent is withdrawn or you unsubscribe from the list.
Publication of product reviews — Legal basis: consent (Art. 6(1)(a) GDPR). Retention: until you request removal.
Website statistics and personalised advertising — Legal basis: consent given via the cookie banner (Art. 6(1)(a) GDPR). Retention: according to the durations stated in the Cookie Policy.
Website security, fraud prevention and the establishment, exercise or defence of legal claims — Legal basis: legitimate interest (Art. 6(1)(f) GDPR). Retention: for the time strictly necessary and in any case no longer than the applicable limitation periods.

Providing the data marked as mandatory in the order forms is necessary to complete the purchase: without it we cannot fulfil your order. Providing data for newsletter and marketing purposes is always optional and can be withdrawn at any time.

4. Confidentiality of your purchases

We sell adult products and we are aware that data relating to your orders deserves particular confidentiality. We do not intentionally process special categories of personal data within the meaning of Art. 9 GDPR, and we do not use the products you buy to derive information about your private life beyond the purposes set out in section 3. Orders are shipped in discreet packaging with no reference to the contents, and access to order data is restricted to those who need to process it to fulfil the order.

5. Who we share your data with

Your data is not made public. It may be disclosed to the following categories of recipients, acting either as processors on our behalf or as independent controllers, each only to the extent strictly necessary:

Shopify, the platform hosting the store — operation of the website, cart, checkout and customer accounts; storage of store data.
The supplier that prepares and ships orders on our behalf — receives the name, address and contact details needed for delivery, together with the list of items to be shipped.
Couriers and shipping services — delivery of the parcel and tracking communications.
Payment service providers and card networks — processing and verification of payments, handling of refunds, fraud prevention.
Email marketing platform — sending the newsletter and promotional communications, if you have given your consent.
Providers of online analytics and advertising tools — measurement of traffic and advertising campaigns, only with your prior consent to cookies. The list is in the Cookie Policy.
Review collection and publication service — invitations to leave a review and publication of the review on the website.
Tax, accounting and legal advisers — administrative obligations and protection of rights.
Public authorities and supervisory bodies — only where required by law or by a legitimate request.

You can request the up-to-date list of processors, including their names, by writing to info@vibryz.com.

6. Cookies, analytics and advertising

We use technical cookies necessary for the website to function and, subject to your consent, preference, analytics and marketing cookies. You can give, change or withdraw your choices at any time as described in the Cookie Policy.

If you reside in a jurisdiction that grants this right, you can also object to the sharing of your data for targeted advertising purposes on the Your privacy choices page.

7. Transfers of data outside the European Economic Area

Store data is hosted by Shopify on servers located in the European Union. Some of the providers listed in section 5, in particular online analytics and advertising providers, are based in or use infrastructure in the United States. In these cases the transfer takes place on the basis of the safeguards provided for in Chapter V GDPR: adequacy decisions of the European Commission or standard contractual clauses, together with supplementary measures where necessary. You can request a copy of the safeguards adopted by writing to info@vibryz.com.

8. Data security

We adopt appropriate technical and organisational measures to protect your data: encrypted connection across the entire website, access to the administration panel restricted and protected by personal credentials, and use of providers that guarantee adequate security standards. However, no system can be considered absolutely secure: please keep your account credentials safe and do not share them with anyone.

9. Children's data

This website sells products intended for an adult audience. The Services are not intended for persons under 18 years of age and we do not knowingly collect their personal data. If you believe that a minor has provided us with their data, please write to info@vibryz.com: we will delete it without delay.

10. Automated decision-making and profiling

We do not use solely automated decision-making that produces legal effects concerning you or similarly significantly affects you. If you have consented to marketing cookies or to the newsletter, your browsing and purchase data may be used to show you more relevant content and ads. You can object to this processing at any time by withdrawing your consent.

11. Your rights

At any time you can exercise the rights provided for in Articles 15 to 22 GDPR:

Access: find out what data we process and obtain a copy of it.
Rectification: correct inaccurate data or complete incomplete data.
Erasure: request the deletion of your data, within the limits of the retention obligations imposed by law.
Restriction: request that processing be suspended in certain cases.
Portability: receive your data in a machine-readable format or have it transmitted to another controller.
Objection: object to processing based on legitimate interest and, in any case and without giving reasons, to direct marketing.
Withdrawal of consent: at any time, without affecting the lawfulness of processing carried out before the withdrawal.

To exercise your rights, write to info@vibryz.com. We will reply within one month of receiving your request; this period may be extended by two further months for particularly complex requests, in which case we will inform you. We may need to ask you to verify your identity before acting on your request.

If you believe that the processing of your data infringes the law, you have the right to lodge a complaint with the Garante per la protezione dei dati personali (the Italian Data Protection Authority, www.garanteprivacy.it) or to seek a judicial remedy.

12. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in the services we use, in our organisation or in applicable law. The updated version is published on this page with a new "last updated" date. In the event of material changes, we will notify you by appropriate means.

13. Contact

For any questions about this Privacy Policy or the processing of your personal data:

Giuseppe Sanfilippo — Vibryz
Via Cumiana 5, 10045 Piossasco (TO), Italy
Partita IVA (IT) 12772030016
Email: info@vibryz.com