Data Controller

Chiclitic Srl
Via 3 Novembre 58, 35020 Tombelle di Saonara (PD) – Italy
VAT No. 04483980282 – Tel. +39 049 0993665 – info@oujur.com

Purposes and Legal Bases of Processing

Personal data provided by users are processed for the following purposes:

1. Management of orders, payments, and shipments

Legal basis: performance of a contract (Art. 6.1.b GDPR) and compliance with legal obligations in tax/accounting matters (Art. 6.1.c GDPR).

2. Responding to information or assistance requests

(contact forms, email, telephone, chat)
Legal basis: execution of pre-contractual measures and the Data Controller’s legitimate interest in managing user requests (Art. 6.1.b–f GDPR).

3. Sending commercial communications and newsletters

Legal basis: user consent (Art. 6.1.a GDPR).
Consent may be withdrawn at any time or users may unsubscribe via the link in each communication or by contacting the Data Controller.

4. Analytics, profiling, and tracking for statistical and marketing purposes

Tools used: Google Analytics, Google Ads, Meta Pixel, Instagram, Facebook, LinkedIn.
Legal basis: consent (Art. 6.1.a GDPR).
In the absence of consent, such activities will not be carried out (except for technical cookies).

5. Website security and fraud prevention

(technical logs, anti-fraud checks on payments)
Legal basis: legitimate interest of the Data Controller (Art. 6.1.f GDPR) and, where applicable, compliance with legal obligations (Art. 6.1.c GDPR).

Nature of Data Provision

Providing personal data for purchase, delivery, and invoicing is mandatory. Failure to provide such data will make it impossible to process the order.

Providing data for marketing and profiling purposes is optional. Refusal will not affect the provision of other services.

Recipients and Categories of Data Processors

Personal data may be communicated to:

IT and hosting service providers, maintenance, CRM, email marketing;

Payment platforms and financial institutions;

Couriers and shipping companies;

Consultants (accountants, legal advisors) and subjects processing data for legal obligations;

Group companies and contractual partners of the Data Controller.

Such entities operate, where required, as Data Processors pursuant to Art. 28 GDPR or as independent Data Controllers.

Data Transfers Outside the EU

The use of tools such as Google Analytics / Ads and Meta Pixel may involve the transfer of data to non-EU countries (e.g., the United States).
In such cases, Chiclitic Srl adopts Standard Contractual Clauses (SCCs) and additional safeguards, where necessary, in accordance with Articles 44–49 of the GDPR.

Data Retention Periods

Invoicing data: 10 years (legal obligation);

Contact/assistance data: for the time necessary to process the request and up to 24 months for internal traceability;

Marketing data: until consent withdrawal or, in the absence of activity, for up to 24 months;

Profiling/analytics data: up to 24 months (or shorter periods provided by the tools used);

Technical and security logs: up to 12 months, unless required for judicial purposes.

Data Subject Rights

At any time, the user may exercise the rights provided for by Articles 15–22 GDPR, including:
access, rectification, erasure, restriction, objection to processing, data portability, and withdrawal of consent, without affecting the lawfulness of processing based on consent before its withdrawal.

Requests should be sent to: info@oujur.com
.

The user also has the right to lodge a complaint with the Italian Data Protection Authority: www.garanteprivacy.it