Data Protection Privacy & Transparency

Privacy Policy

This Privacy Policy explains how we collect, use, share and protect the personal data of people who visit and use cartdeal.shop.

Last updated: 29 September 2026

1. Introduction

This Privacy Policy explains how we collect, use, share and protect the personal data of people who visit and use the website cartdeal.shop (the "Website"). It is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR") and applicable Italian data protection law, including Legislative Decree 196/2003 as amended (the "Privacy Code").

We encourage you to read this Policy carefully. If you have any questions, you can contact us using the details in Section 2.

2. Data Controller

The Data Controller responsible for your personal data is:

WEPROD S.R.L.
Via Ferrante Imparato 190, Edif. 3
Condominio Napoli Est, P3 Int. 301
80146 Napoli (NA), Italy
VAT Number: IT10883491218
Email: [email protected]

The Data Controller has not appointed a Data Protection Officer (DPO), as this is not required for its activities. All privacy requests can be sent to the email address above.

3. Personal Data We Collect

3.1 Data you provide to us

We collect the information you give us when you create an account, place an order, contact customer support or subscribe to our newsletter. This typically includes your full name, email address, phone number, and billing and shipping addresses.

3.2 Order and transaction data

When you make a purchase, we process information about the products you buy, your order history, order value, delivery details and the confirmation status of your payment.

3.3 Payment data

Payments are handled entirely by secure, certified third-party payment providers. We do not collect or store your full credit card number or other sensitive payment credentials; we only receive confirmation of whether a payment was successful.

3.4 Data collected automatically

When you browse the Website, our systems and those of our service providers may automatically record technical information such as your IP address, browser type and version, device type, operating system, referring URLs, pages visited, time spent on each page and your navigation path through the Website.

3.5 Cookies and similar technologies

The Website uses technical cookies, which are necessary for it to function, and, only with your prior consent, analytics, marketing and profiling cookies, tracking pixels and similar technologies.

Full details, including how to manage your preferences, are available in our Cookie Policy .

4. Why We Process Your Data and on What Legal Basis

The table below sets out each purpose for which we use your data, the legal basis that allows us to do so, and how long we keep the data.

Purpose

Legal basis (GDPR)

Retention period

Processing, fulfilling and delivering orders; managing payments; providing customer support

Performance of a contract or pre-contractual steps (Art. 6(1)(b))

For the duration of the contractual relationship, then as required for legal purposes

Creating and managing your customer account

Performance of a contract (Art. 6(1)(b))

Until you delete your account

Complying with tax, accounting and other legal obligations

Legal obligation (Art. 6(1)(c))

Up to 10 years, as required by Italian law

Preventing fraud, detecting abuse and protecting our systems

Legitimate interest (Art. 6(1)(f))

For as long as necessary for the purpose, and in any case no longer than 24 months, unless needed to defend legal claims

Analysing Website traffic and improving performance and user experience

Consent (Art. 6(1)(a)), except for anonymised statistics

Until consent is withdrawn, or as indicated in the Cookie Policy

Sending newsletters and promotional communications

Consent (Art. 6(1)(a))

Until consent is withdrawn

Sending offers on products similar to those you have already purchased, to the email address you gave us at checkout

Legitimate interest (Art. 6(1)(f) GDPR and Art. 130(4) Privacy Code)

Until you object, which you can do at any time

Remarketing, personalised advertising and profiling

Consent (Art. 6(1)(a))

Until consent is withdrawn, and in any case no longer than 12 months

Where we rely on legitimate interest, we have carefully balanced our interests against your rights and freedoms. You can ask us for more information about this assessment.

5. Is Providing Your Data Mandatory?

Providing the data needed to create an account or complete an order is necessary: without it, we cannot process your purchase.

Providing data for marketing and analytics is entirely optional, and refusing will have no effect on your ability to buy from us.

6. Analytics, Advertising and Remarketing Services

With your consent, we use third-party services to measure Website traffic, understand how visitors use our pages, deliver targeted advertising and assess the effectiveness of our campaigns.

Remarketing tools may record your interactions with the Website so that relevant ads can be shown to you on other websites and platforms.

These services may collect browsing activity, interaction events, device identifiers and advertising IDs. Some providers may combine this information with data they have obtained independently, in accordance with their own privacy policies, for which they act as independent controllers.

A full list of the providers used, with links to their privacy policies, is available in our Cookie Policy .

7. Who We Share Your Data With

We share your personal data only where necessary for the purposes described above, with the following categories of recipients:

Hosting and content delivery network (CDN) providers
Payment service providers
Shipping and logistics companies
Analytics and advertising partners
IT and technical service providers
Legal, tax and accounting advisors

Data may also be disclosed to public authorities where required by law.

These recipients act either as data processors, appointed under a written agreement pursuant to Article 28 GDPR, or as independent data controllers. An up-to-date list of processors is available on request.

We never sell your personal data.

8. International Data Transfers

Some of our service providers may process data outside the European Economic Area (EEA).

In such cases, transfers take place only to countries covered by a European Commission adequacy decision (including, for certified companies, the EU-U.S. Data Privacy Framework) or on the basis of Standard Contractual Clauses approved by the European Commission, together with any additional measures that may be necessary.

You can request a copy of the safeguards in place by contacting us.

9. Your Rights

Under the GDPR, you have the right to:

access your personal data and obtain a copy of it;
rectify inaccurate or incomplete data;
erase your data ("right to be forgotten"), where the legal conditions are met;
restrict the processing of your data in certain circumstances;
object to processing based on legitimate interest, and to object at any time to direct marketing, including related profiling;
data portability, meaning you can receive your data in a structured, commonly used, machine-readable format and have it transferred to another controller;
withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise your rights, write to [email protected] . We will respond without undue delay and in any case within one month of receiving your request.

This period may be extended by two further months for complex requests, in which case we will inform you. Exercising your rights is free of charge. We may ask you to verify your identity before responding.

You can also unsubscribe from promotional emails at any time by clicking the link at the bottom of each message.

10. Right to Lodge a Complaint

If you believe that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or with the supervisory authority of the EU country where you live or work, or where the alleged infringement occurred.

Italian Data Protection Authority: garanteprivacy.it

11. Data Security

We implement appropriate technical and organisational measures to protect your personal data against loss, misuse and unauthorised access, disclosure, alteration or destruction.

These include encrypted connections (SSL/TLS), access controls restricted to authorised personnel, secure servers, and continuous monitoring and prevention systems.

While no system can guarantee absolute security, we regularly review our measures to keep them effective.

12. Profiling and Automated Decision-Making

With your consent, we may use automated tools to analyse your browsing behaviour and preferences in order to personalise content and show you relevant advertising.

We do not make any decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you, within the meaning of Article 22 GDPR.

13. Data Minimisation and Accuracy

We collect only the data that is adequate, relevant and limited to what is necessary for the purposes described in this Policy.

We take reasonable steps to keep your data accurate and up to date, and we invite you to update your account information or contact us if anything changes.

14. Third-Party Websites

The Website may contain links to websites operated by third parties. We are not responsible for the content or privacy practices of those websites, and we encourage you to read their privacy policies before providing any personal data.

15. Minors

The Website and our products are intended for people aged 18 and over. We do not knowingly collect personal data from minors.

If you believe a minor has provided us with personal data, please contact us and we will delete it promptly.

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in the law, our services or our practices.

The date of the latest update is shown at the top of this page. Where changes are significant, we will notify you through the Website or by email.

Privacy requests: To exercise your privacy rights or request information about the processing of your personal data, contact [email protected] . For information about cookies, analytics and advertising technologies, see our Cookie Policy .