Privacy policy

Data controller

[to be completed], [to be completed], VAT [to be completed]. Email: [to be completed]. Certified email (PEC): [to be completed].

What data we process

• Account: name, email or phone number, password (stored encrypted) and preferred language. If you sign in with Google or Facebook we receive your name, email and profile picture from them, never your password; if you sign in with your phone, we text a code to that number.
• Orders: shipping address, phone, products bought, amounts, delivery status and tracking.
• Cart: if you're signed in, we also save the products you put in your cart, so you find them on another device and we can remind you if you leave them there.
• Gift lists: a list's title, date, message and products are visible to anyone with its link; guests who give a gift leave their name and a message, which the list's owner sees (in surprise mode only from the day of the event).
• Payments: outcome and amounts. Card details are handled only by the payment provider, never by us.
• Reports, returns, reviews and questions: the texts and photos you send us.
• Sellers: business and owner details, payout account and the documents uploaded for verification.
• Technical data: IP address, security logs and technical cookies.
• Shopping assistant: the questions you write in the assistant's chat. We send them to the artificial intelligence provider only to generate the answer and don't keep them; to prevent abuse we count how many questions each user asks (for visitors who aren't signed in, through a code derived from the IP address).
• Photo search: the photo you use to look for a product. We analyse it on our own servers only to find similar products and don't keep it; to prevent abuse we count how many searches each user makes, as for the assistant.

Why we process it

• To run accounts, orders, payments, shipping and returns: performance of a contract (art. 6.1.b GDPR).
• To meet tax and accounting duties and the rules for marketplaces, such as verifying sellers: legal obligation (art. 6.1.c).
• To protect buyers and sellers from fraud and abuse, handle disputes and keep the site secure: legitimate interest (art. 6.1.f).
• To remind you of products left in your cart, at most once a week: legitimate interest (art. 6.1.f). You can turn the reminders off on the Notifications page.
• To send you offers and news, if we start doing so: only with your consent, which you can withdraw at any time.

Who we share it with

• The seller you buy from: name, shipping address and phone, only to ship the order.
• Carriers, through the seller, for delivery. We only send the tracking number to the carriers' websites.
• Providers that help us run the service, appointed as data processors: database and storage (Supabase), website hosting (Vercel), artificial intelligence for the shopping assistant and automatic translations (Anthropic), payment, email and SMS services.
• If you sign in with Google or Facebook, that service knows you use Zablas and handles the data as an independent controller, under its own privacy policy.
• Authorities, when the law requires it.

We never sell your data.

Transfers outside the EU

Some providers may process data outside the European Economic Area. In that case the transfer relies on an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework) or on standard contractual clauses.

How long we keep it

• Account: while it's active. After it's closed we delete or anonymise the data, except what the law requires us to keep.
• Orders and accounting records: 10 years (art. 2220 of the Italian Civil Code).
• Seller verification data: for the whole relationship and 6 months after it ends (Regulation (EU) 2022/2065).
• Reports and disputes: up to 2 years after they're closed, unless legal proceedings are ongoing.
• Security logs: up to 12 months.

Cookies

We only use technical cookies, needed to sign in and keep your cart. We don't use profiling or advertising cookies, so we don't ask for consent. If we ever add them, we'll ask you first.

Your rights

You can ask at any time to access, correct or delete your data, restrict its processing, receive it in a readable format (portability) and object to processing based on legitimate interest. Write to [to be completed]: we reply within one month.

To delete your account and your data: Your account → Personal details → “Ask to delete my account”, or write to [to be completed]. We delete them within 30 days, except orders and invoices the law requires us to keep. If you sign in with Google or Facebook you can also remove Zablas from the connected apps in your Google or Facebook account settings.

If you think the processing breaches the GDPR you can complain to the Italian Data Protection Authority (www.garanteprivacy.it) or to the authority of your country.

Security

We protect data with encrypted connections and role-based access enforced in the database: each customer sees only their own orders, and each seller only the data needed to ship.