Privacy Policy
This Privacy Policy explains how we collect and use personal data when you visit or buy from marcomoreo.com.
1. WHO IS RESPONSIBLE FOR YOUR DATA
The data controller is:
Catlan Trading Limited, trading as Marco Moreo Milano
Registered in Ireland, company registration number 545748
Registered office: 15 Sutton Lawns, Dublin 13, Sutton, Dublin, D13 V1K7, Ireland
VAT no. IE3273013OH
Email: support@marcomoreo.com
We have not appointed a Data Protection Officer, as we are not required to do so. All privacy enquiries should be sent to the email address above.
Orders placed on this website are fulfilled from a warehouse in Italy. This means that the information needed to pick, pack, invoice and ship your order and to process returns is handled there by our fulfilment and logistics partners, on our behalf and under our instructions. Section 5 describes who receives your data.
2. WHAT DATA WE COLLECT
Data you give us
- Identity and contact details: first name, last name, email address, telephone number where you provide it
- Delivery and billing addresses
- Order details: the products, sizes and quantities you buy, the price paid, any discount code used, and your chosen delivery and payment method
- Correspondence with our customer service, including the content of your messages
- Information you give us when you exercise your right of withdrawal or request a return or exchange
- If you create a customer account, your account credentials and order history. You can also order as a guest, without creating an account.
Data we collect automatically
- Technical data: IP address, device and browser type, operating system, language and country
- Usage data: pages viewed, products viewed, searches run on the site, items added to or removed from the basket, and how you arrived at the site
- Data collected through cookies and similar technologies, as described in our Cookie Policy
- If you have consented, whether and when you open our marketing emails and which links you click
Data we receive from others
- Confirmation of payment, and the result of fraud and risk checks, from our payment providers. We never receive or store your full card number.
- Delivery status information from our carriers
- Where you consent, aggregated advertising measurement data from advertising platforms
We do not knowingly collect data from children. This website is not directed at children under 16, and we do not knowingly process their personal data. If you believe a child has provided us with data, please contact us and we will delete it.
We do not intentionally collect special categories of data, such as data about health, and we ask you not to send us such information.
3. WHY WE USE YOUR DATA, AND ON WHAT LEGAL BASIS
We only process personal data where we have a legal basis under Article 6 of the GDPR. The table below sets out each purpose and its basis.
| Purpose | Legal basis |
|---|---|
| Taking and fulfilling your order, arranging delivery, and communicating with you about it | Performance of a contract, Article 6(1)(b) |
| Processing payment | Performance of a contract, Article 6(1)(b) |
| Handling your right of withdrawal, returns, exchanges, refunds and warranty claims | Performance of a contract and compliance with a legal obligation, Articles 6(1)(b) and 6(1)(c) |
| Customer service and answering your enquiries | Performance of a contract, or our legitimate interest in responding to you where no contract exists, Articles 6(1)(b) and 6(1)(f) |
| Invoicing, accounting and tax record keeping | Compliance with a legal obligation, Article 6(1)(c) |
| Preventing and detecting fraud and abuse, and keeping the website secure | Our legitimate interest in protecting our business and our customers, Article 6(1)(f) |
| Sending you marketing emails | Your consent, Article 6(1)(a) |
| Measuring whether you open our marketing emails and which links you click | Your consent, given separately from your consent to receive the emails, Article 6(1)(a) |
| Grouping customers into segments based on purchase and browsing history, so that the marketing you receive is more relevant | Your consent, Article 6(1)(a) |
| Measuring the performance of our advertising and building advertising audiences on third party platforms | Your consent, Article 6(1)(a) |
| Understanding how the website is used, in order to improve it | Your consent, Article 6(1)(a) |
| Establishing, exercising or defending legal claims | Our legitimate interest in protecting our legal position, Article 6(1)(f) |
Where we rely on your consent, you can withdraw it at any time and this will not affect the lawfulness of processing carried out before you withdrew it. Withdrawing consent to marketing or tracking has no effect on your ability to buy from us or on any order already placed.
Where we rely on legitimate interests, you have the right to object, and we will stop unless we have compelling grounds to continue. Section 8 explains how.
4. PROFILING AND AUTOMATED DECISION-MAKING
We use your purchase and browsing history to place you into marketing segments, for example customers who bought a particular category, or customers who have not bought for some time, so that the emails and advertising you see are more relevant. Where you have consented, we also share identifiers with advertising platforms so that they can show our advertising to you or to people with similar characteristics. This is profiling for marketing purposes and you can object to it or withdraw your consent at any time.
We do not take decisions about you based solely on automated processing that produce legal effects concerning you or otherwise significantly affect you, within the meaning of Article 22 of the GDPR. Our segmentation only affects the marketing you receive. It does not affect the price you pay, whether we accept your order, or the terms on which we sell to you.
If you choose to pay with Klarna, Klarna carries out its own assessment of your application, which may include an automated creditworthiness check. Klarna acts as an independent data controller for that assessment, not on our behalf, and it is Klarna that decides whether to make its payment options available to you. Please refer to Klarna's own privacy notice for information about that processing and about the rights you have in relation to it, including the right to obtain human intervention.
5. WHO WE SHARE YOUR DATA WITH
We share personal data only where it is necessary for the purposes described above. Our main recipients are set out below. Some act as processors on our instructions, and some act as independent controllers for their own purposes.
| Recipient | Role | Why |
|---|---|---|
| Shopify (Shopify International Limited, Ireland, and its affiliates including Shopify Inc., Canada) | Processor | Hosts this online store and processes orders, customer accounts and store analytics |
| Shopify Payments | Processor and, for regulatory purposes, controller | Processes card payments and carries out fraud and risk checks |
| Klarna Bank AB (publ), Sweden | Independent controller | Provides its payment options, and carries out its own identity and creditworthiness assessment |
| Our fulfilment and logistics partners in Italy | Processors | Pick, pack and dispatch orders, and receive and process returns |
| Mail Boxes Etc. and the carriers it uses | Processors, and controllers for their own regulatory purposes | Deliver your order and return shipments, and handle customs formalities outside the EU |
| Klaviyo, Inc., United States | Processor | Sends our marketing and transactional emails and stores marketing consents and segments |
| Meta Platforms Ireland Limited | Independent or joint controller, depending on the processing | Measures our advertising on Facebook and Instagram and builds advertising audiences, where you have consented |
| Revoq | Processor | Operates the online withdrawal function through which you can cancel your order |
| Our accounting and invoicing providers, and the connector used to transfer order data to them | Processors | Issue invoices and maintain accounting records |
| Operational apps installed on our store, including tools for order documents, inventory and on-site search | Processors | Support day to day running of the store; some of these access order data |
| Our professional advisers, including accountants, auditors and lawyers | Controllers or processors depending on the engagement | Provide advice and assistance to us |
| Public authorities, courts and regulators | Controllers | Where we are required by law to disclose data, or where disclosure is necessary to defend legal claims |
We do not sell your personal data, and we do not disclose it publicly.
If our business or part of it is transferred or reorganised, personal data may be disclosed to the parties involved, subject to appropriate confidentiality safeguards and to our obligation to inform you where required.
An up to date list of the processors we use, including their identity, is available on request from support@marcomoreo.com.
6. TRANSFERS OUTSIDE THE EUROPEAN ECONOMIC AREA
Most of your data is processed within the EEA. Some of our providers, in particular Klaviyo and certain Shopify affiliates, process data in the United States or Canada. Where you place an order for delivery outside the EEA, delivery and customs data is necessarily transferred to the destination country.
Where we transfer personal data outside the EEA we rely on one or more of the following:
- An adequacy decision of the European Commission, where one covers the recipient country or framework
- The European Commission's Standard Contractual Clauses, together with an assessment of the transfer and any additional safeguards required
- Where relevant, a derogation under Article 49 of the GDPR, for example where a transfer is necessary to perform a contract with you, as is the case for international deliveries
You can request a copy of the safeguards we rely on for a specific transfer by writing to support@marcomoreo.com.
7. HOW LONG WE KEEP YOUR DATA
| Data | Retention period |
|---|---|
| Order, invoice and accounting records | At least 6 years from the end of the relevant financial year, as required by company and tax law, and longer where a longer period is required by applicable law |
| Customer account data | For as long as your account is open, and for 6 years after your last order for the records above |
| Customer service correspondence | 2 years from the close of your enquiry |
| Marketing data, consents and segments | Until you withdraw consent or object, and in any event no more than 24 months after your last interaction with us. We keep a minimal record of a withdrawal or objection indefinitely, so that we can honour it. |
| Withdrawal and return records | For the duration of the applicable limitation period, and as part of the accounting records above |
| Cookie and similar data | As set out in our Cookie Policy |
When a retention period ends we delete the data or irreversibly anonymise it. Where we are required to keep a record for legal reasons, we restrict access to it rather than continue to use it.
8. YOUR RIGHTS
You have the right to:
- Obtain confirmation of whether we process your data, and a copy of it, together with the information in this policy
- Have inaccurate or incomplete data corrected
- Have your data erased, where we no longer have a lawful reason to keep it
- Restrict our processing in certain circumstances, for example while a dispute about accuracy is resolved
- Receive the data you provided to us in a structured, commonly used and machine readable format, and have it transmitted to another controller, where processing is based on your consent or on a contract and carried out by automated means
- Object to processing based on our legitimate interests, and to object at any time and without giving a reason to processing for direct marketing purposes
- Withdraw your consent at any time, where processing is based on consent
- Lodge a complaint with a supervisory authority
To exercise any of these rights, write to support@marcomoreo.com. We will respond within one month. If your request is complex we may extend that period by up to two further months, and we will tell you if we do. We may ask you for information to confirm your identity before we act, and only for that purpose.
You can manage your marketing choices directly, without making a formal request, through our Email Preferences page, the unsubscribe link in any marketing email, and the Cookie Preferences link in the footer of any page.
Complaints. If you are not satisfied with how we have handled your data, you can lodge a complaint with the data protection authority of the country where you live or work, or where you believe the problem occurred. Our lead supervisory authority is:
Data Protection Commission
6 Pembroke Row, Dublin 2, D02 X963, Ireland
www.dataprotection.ie
You are also always welcome to raise the matter with us first.
9. IF YOU ARE OUTSIDE THE EUROPEAN ECONOMIC AREA
United Kingdom. If you are in the United Kingdom, the UK GDPR and the Privacy and Electronic Communications Regulations apply to our processing of your data. The rights described in section 8 apply to you in equivalent form, and you may complain to the Information Commissioner's Office at ico.org.uk.
Switzerland. If you are in Switzerland, the Federal Act on Data Protection applies alongside this policy, and you may contact the Federal Data Protection and Information Commissioner.
United States and other countries. Depending on where you live, you may have additional rights, including the right to know what personal data we collect, to request deletion or correction, and to opt out of the sale or sharing of personal data and of targeted advertising. We do not sell personal data. Where you have consented to advertising cookies, information may be shared with advertising platforms in a way that some laws treat as sharing for targeted advertising, and you can stop this at any time using the Cookie Preferences link. We honour Global Privacy Control signals sent by your browser. To make any other request, write to support@marcomoreo.com. We will not discriminate against you for exercising these rights.
10. SECURITY
We use providers that apply recognised technical and organisational security measures, including encryption of data in transit, access controls and logging. Payment card details are handled by our payment providers and are never stored on our systems. No transmission over the internet can be guaranteed to be completely secure, so please contact us immediately if you believe your account or your data has been compromised.
11. CHANGES TO THIS POLICY
We will update this policy when our processing, our providers or the applicable law change. The date at the top of this page shows when it was last revised. Where a change is material, we will bring it to your attention, and where a new purpose requires your consent we will ask for it before that processing begins.
12. CONTACT
Catlan Trading Limited, 15 Sutton Lawns, Dublin 13, Sutton, Dublin, D13 V1K7, Ireland
support@marcomoreo.com