Privacy Policy

Privacy Policy

Notice pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR").

1. Data controller

EUROMART DI DI FRAIA FLAVIO, registered office at VIA A. POLIZIANO 6, 81030, CASTEL VOLTURNO (CE), VAT IT09831321212 ("Droio"). Data protection contact: support@droio.com.

2. Data we process

  • Account data: first name, last name, email, password (hashed);
  • Delivery and billing data: address, city, postcode, phone;
  • Order data: purchase history, amounts, payment method (Droio does not store full card numbers);
  • Browsing data: IP address and connection logs;
  • Purchase measurement data (with consent): conversion event on the order confirmation page via Google Tag Manager (container GTM-PKSX6F34), including order reference, value, currency and products; any linked Google analytics cookies;
  • Newsletter: email address, after double opt-in;
  • Support requests: content of messages sent via the contact form or the on-site help chat (optional name and email, language, page visited, technical conversation identifier).

3. Purposes and legal bases

  • Account and order management — performance of a contract (Art. 6(1)(b) GDPR);
  • Tax and accounting — legal obligation (Art. 6(1)(c) GDPR);
  • Newsletter — consent (Art. 6(1)(a) GDPR), withdrawable at any time;
  • Conversion measurement (confirmed orders) (Google Tag Manager + Consent Mode on order confirmation; Google Ads where configured) — consent (Art. 6(1)(a) GDPR), collected via the cookie banner; withdrawable at any time;
  • Customer support (contact form and on-site chat) — legitimate interest (Art. 6(1)(f) GDPR);
  • Security and fraud prevention (connection logs; Stripe cookies at checkout) — legitimate interest (Art. 6(1)(f) GDPR).

4. Recipients

Data may be shared with: Hetzner Online GmbH (hosting, Germany); payment service providers Stripe (cards, Klarna where used, and Link) and PayPal (including Google Pay / Apple Pay where used via PayPal); transactional email provider Namecheap PrivateEmail (mail.privateemail.com); Google Ireland Limited / Google LLC for Google Tag Manager (purchase measurement on order confirmation, only after analytics consent); EU carriers for delivery. Where they act as processors, arrangements under Art. 28 GDPR apply. Each PSP and Google may also process data as an independent controller under its own privacy notice.

5. Transfers outside the EEA

Orders are shipped from warehouses located in the European Union. Customer delivery data (name, address, phone) is not transferred to China or other third countries for fulfilment. The website and database are hosted by Hetzner Online GmbH in Germany (EU). Product-sourcing tools used by the administration (e.g. B2B platforms) do not receive shop customers' personal data.

If you consent to analytics cookies, on the order confirmation page only Google Tag Manager may involve transfers to the United States (Google LLC) under Google's safeguards (standard contractual clauses / Data Privacy Framework, where applicable). Details: Google Privacy Policy.

6. Retention periods

  • Account data: until the account is deleted;
  • Order and billing data: 10 years (tax obligations);
  • Connection logs (IP): maximum 6 months;
  • Transactional email log: maximum 12 months;
  • Newsletter email: until consent is withdrawn;
  • Support requests (contact form and chat): 24 months from last activity or case closure;
  • Google analytics cookies / identifiers (only with consent and a visit to order confirmation): according to tag settings (typically up to 24 months) or until consent is withdrawn.

7. Your rights

Under Articles 15-22 GDPR you may exercise your rights of access, rectification, erasure, restriction, portability and objection by writing to support@droio.com or from the "GDPR - Personal data" section of your account, where you can download your data as CSV/PDF and rectify your profile details. Erasure and requests for restriction/objection are handled by writing to support@droio.com (or via the contact form). You may also lodge a complaint with the Italian supervisory authority (www.garanteprivacy.it).

8. Cookies

This site uses technical cookies required for operation (no consent required). Only on the order confirmation page we load Google Tag Manager (container GTM-PKSX6F34) with Consent Mode v2 (Advanced): defaults are denied; Google analytics/ads cookies start only after “Analytics” consent. Without consent, Google may use conversion modeling without setting those cookies. GTM is not present on catalogue, cart or other pages.

  • PHPSESSID — technical server session. Duration: 24 hours.
  • PrestaShop-* — cart, authentication, language and recently viewed products. Duration: 20 days.
  • droio_cookie_consent — stores your cookie preferences. Duration: 12 months.
  • droio_help_token (browser local storage, not a cookie) — technical identifier for the help chat, created only when you use the chat. Duration: until you clear site data.
  • __stripe_mid, __stripe_sid — set by Stripe for fraud prevention on payment pages only. Duration: 1 year and 30 minutes respectively.
  • _ga, _ga_*, _gid (and similar) — set by Google measurement tags loaded via Tag Manager only after “Analytics” consent. Duration: typically up to 24 months / 24 hours depending on the tag.

Google Tag Manager is present only on order confirmation; the banner updates Consent Mode (Accept/Reject/Customize). Payment provider scripts (Stripe, PayPal) remain checkout-only. Notices: Google, Stripe, PayPal.

You can review or withdraw your preferences at any time using the "Cookie preferences" link at the bottom of every page, or by deleting cookies in your browser settings.

9. Provision of data

Data marked as mandatory is required to conclude the contract; failure to provide it prevents order fulfilment. Providing data for marketing purposes is optional.