1. Data Controller

The data controller for personal data is:

Giorgia Gamba

ommi.shop

Email: privacy@ommi.shop

For any request related to the processing of personal data, you can contact the controller at the email address above.

2. Personal Data Collected

We collect and process the following categories of personal data:

• Data provided directly by the user
• Data collected automatically during navigation
• Data received from third parties (when applicable)

2.1 Data Provided Directly

When you fill out forms on the Site, subscribe to the newsletter, register as an artist/merchant on the marketplace, or interact with our services, we collect:

• Artist identification data: first name, last name, artist name, email address, phone number (when provided)
• Account data: username, password (encrypted), user preferences
• Contact data: email address used for newsletter subscription and to receive promotional communications
• Marketplace registration data: information necessary to create a merchant account (managed through the dedicated merchant app)
• Communication data: messages, support requests, feedback sent through contact forms
• Product data (items): information about products that artists publish on the marketplace through the merchant app, including images, descriptions, prices, and other information related to items

2.2 Data Collected Automatically

During navigation on the Site, we automatically collect:

• Technical data: IP address, browser type, operating system, screen resolution
• Navigation data: pages visited, time spent, navigation paths, links clicked
• Usage data: searches performed, filters applied, products viewed
• Cookies and similar technologies: for more information, see our Cookie Policy

3. Purposes and Legal Basis for Processing

We process personal data for the following purposes and based on the respective legal bases:

3.1 Newsletter and Promotional Communications

We use the email address provided through subscription forms to:

• Send periodic newsletters with updates on new collections, artists, and products available on the marketplace

• Invite subscribers to register on the ommi.shop marketplace to sell their products

• Send promotional communications related to events, special offers, and ommi.shop initiatives

Legal basis: consent of the data subject (Art. 6(1)(a) GDPR). Consent can be withdrawn at any time by clicking the unsubscribe link in any email or by contacting us at privacy@ommi.shop.

3.2 Marketplace Management and Advertising

For registered Artists/Merchants, we process data to:

• Manage the merchant account and enable product (Items) publication through the dedicated merchant app

• Advertise and promote Merchants and their products on the ommi.shop marketplace

• Advertise and promote the ommi.shop marketplace and available products

• Communicate with Artists/Merchants regarding the management of their account and products

• Allow Artists/Merchants to modify and manage their data and products through the dedicated merchant app

Legal basis: contract performance (Art. 6(1)(b) GDPR) and legitimate interest (Art. 6(1)(f) GDPR) for marketing and advertising activities.

3.3 Security and Service Improvement

We process data to:

• Ensure Site security and prevent fraud, abuse, and illegal activities

• Analyze Site usage to improve functionality and user experience

• Develop new features and services

Legal basis: legitimate interest (Art. 6(1)(f) GDPR) for security and service improvement.

4. Data Retention Period

We retain personal data for the time necessary for the purposes for which they were collected:

• Newsletter data: until consent withdrawal or deletion request

• Artist/merchant account data: for the entire duration of the contractual relationship and subsequently for 3 years from account closure

• Product data (Items): for the entire duration of publication on the marketplace and subsequently for 1 year from removal

• Navigation data and cookies: as indicated in the Cookie Policy, generally not more than 24 months

• Contact and communication data: up to 3 years from the end of the relationship or last contact

After the indicated periods, data will be deleted or anonymized securely.

5. Data Communication and Sharing

Personal data may be communicated to:

• Technical service providers: hosting providers, cloud services, email marketing platforms (only for sending newsletters), who act as data processors

• Merchant app service providers: providers that support the functionality of the dedicated merchant app used by artists to manage their data and products

• Competent authorities: when required by law or a judicial authority

We do not sell or transfer personal data to third parties for third-party direct marketing purposes.

6. Data Transfer Outside the EU

Some service providers may be located outside the European Union. In such cases, we ensure that transfers comply with GDPR, through:

• European Commission adequacy decisions

• Standard contractual clauses approved by the European Commission

• Other appropriate legal instruments

For more information on transfers, contact us at privacy@ommi.shop.

7. Data Subject Rights

Under GDPR and Legislative Decree 196/2003 (as amended by Legislative Decree 101/2018), the data subject has the right to:

• Access (Art. 15 GDPR): obtain confirmation of the existence of personal data concerning them and access to such data

• Rectification (Art. 16 GDPR): obtain correction of inaccurate data or completion of incomplete data

• Erasure (Art. 17 GDPR): obtain deletion of data when no longer necessary or in case of consent withdrawal

• Restriction of processing (Art. 18 GDPR): obtain restriction of processing in certain circumstances

• Data portability (Art. 20 GDPR): receive data in a structured format and transmit it to another controller

• Objection (Art. 21 GDPR): object to processing for legitimate reasons or to processing for direct marketing

• Consent withdrawal: withdraw consent at any time, without affecting the lawfulness of processing based on consent before withdrawal

To exercise your rights, you can send a request to privacy@ommi.shop. We will respond within 30 days of the request.

The data subject also has the right to lodge a complaint with the Data Protection Authority (www.garanteprivacy.it) if they believe the processing violates applicable regulations.

8. Security Measures

We adopt appropriate technical and organizational measures to protect personal data from unauthorized access, loss, destruction, or alteration, including:

• Encryption of sensitive data

• Access controls and authentication

• Activity monitoring and logging

• Regular backups and disaster recovery procedures

• Staff training on data protection

9. Children's Data

The Site and ommi.shop services are not intended for minors under 16 years of age. We do not knowingly collect personal data from minors without parental consent. If we become aware that we have collected data from a minor without appropriate consent, we will proceed with immediate deletion.

10. Cookies and Similar Technologies

The Site uses cookies and similar technologies to improve navigation experience, analyze Site usage, and personalize content. For more information, see our Cookie Policy, accessible from the Site footer.

11. Policy Changes

We reserve the right to modify this Policy. Substantial changes will be communicated to data subjects via email or through a notice on the Site. The last update date is indicated at the beginning of this Policy.

We invite you to periodically consult this page to be informed of any updates.

12. Contacts

For any questions, requests, or exercise of rights related to personal data processing, you can contact:

Giorgia Gamba

ommi.shop

Email: privacy@ommi.shop

Website: https://ommi.shop