Privacy policy
Last updated:
This notice explains how we process the personal data of people who visit re-fe.com (the “Site”) and buy Re-fè products, under Regulation (EU) 2016/679 (“GDPR”).
Data controller
ONOFF SRL, Via Vicenza 4, 31100 Treviso (TV), Italy, VAT IT05537320268. Email: team@re-fe.com.
What data we process and why
| Activity | Data | Legal basis | Retention |
|---|---|---|---|
| Order handling, shipping, support and returns | Name, email, phone, shipping and billing addresses, products bought, VAT number if provided | Performance of contract (art. 6.1.b GDPR) | For the duration of the relationship and up to 10 years for tax and accounting duties |
| Tax and accounting obligations | Order and invoice data | Legal obligation (art. 6.1.c GDPR) | 10 years (art. 2220 Italian Civil Code) |
| Replying to email enquiries | Email address and message | Pre-contractual steps or legitimate interest (art. 6.1.b and 6.1.f GDPR) | As long as needed to handle the request, up to 24 months |
| Newsletter (only if you subscribe) | Email address | Consent (art. 6.1.a GDPR), withdrawable at any time | Until you unsubscribe |
| Site security and operation | IP address and technical data in server logs | Legitimate interest in security (art. 6.1.f GDPR) | As set by the hosting provider |
Payment details (card number and similar) are entered directly on Stripe’s secure page and are never transmitted to or stored by us.
Cookies and local storage
The Site does not use profiling cookies, analytics or advertising tools. Your cart is saved in your browser (localStorage) and only contains product codes and quantities: it is a technical tool needed for the service you requested and does not require consent. Stripe’s payment page uses cookies that are strictly necessary and for fraud prevention, as described in Stripe’s privacy notice.
Who we share data with
Data is processed by us and, on our behalf, by providers acting as processors or independent controllers:
- Stripe Payments Europe Ltd. (Ireland): payments and fraud prevention.
- Cloudflare, Inc.: Site hosting and network protection.
- Poste Italiane S.p.A. and other couriers: parcel delivery.
- Our email provider and, if active, our newsletter provider.
- Our accountant and advisers, for legal obligations.
Some providers may process data outside the European Economic Area (e.g. in the United States); in that case transfers rely on a European Commission adequacy decision (EU-US Data Privacy Framework) or Standard Contractual Clauses. We never sell your data.
External links
The Site links to external services such as Calendly (to book a call), Google Forms (to apply for CinCir events), Google Drive (press materials) and our social profiles. When you use them, your data is processed under their own privacy notices.
Your rights
You can ask us at any time for access, rectification, erasure, restriction, portability, or object to processing based on legitimate interest (articles 15-22 GDPR), by emailing team@re-fe.com. Where you gave consent you can withdraw it at any time, without affecting prior processing.
You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the authority of your country.
Changes
We may update this notice. The date of the last update is shown at the top.