Privacy Policy

Pursuant to Articles 4 and 24 of Regulation (EU) 2016/679, the Data Controller is Shoppywhere LLP with registered office at 44-45 Beaufort Court, Admirals Way, London E14 9XL.

Privacy contact email: staff@shoppywhere.com.

2.1 Data provided by the user

During the use of the website, personal data provided directly by the user may be collected, such as:

• Identification data: first name, last name
• Contact data: email address
• Content of the message sent to ShoppyWhere

These data are collected when the user writes to ShoppyWhere by email or through the contact form of the website. The contact form does not send data to the website: it opens the user’s email application with the message ready to be sent, and the message is received at the email address req@shoppywhere.com. Requests concerning personal data must be sent to staff@shoppywhere.com.

These data are processed for the following purposes:

a) Performance of a contract or pre-contractual measures (Art. 6, par. 1, lett. B - GDPR), in particular customer support;

b) Compliance with legal obligations (Art. 6, par. 1, lett. C - GDPR)

Messages sent through the contact form or by email are processed to respond to the user’s request, on the legal basis referred to in point a).

2.2 Data collected automatically

The website’s IT systems and software procedures automatically acquire certain personal data during normal operation, the transmission of which is inherent in the use of web and digital communication protocols. Such data may include:

• technical information about the device used (device type, operating system and related version);
• usage data and access logs;
• date and time of operations performed.

On the website, these data include the IP address, the requested URL, the browser user agent and the date and time of the request, recorded in the server logs of the hosting provider Vercel Inc.

These data are processed, pursuant to Art. 6, par. 1, lett. b and f of Regulation (EU) 2016/679 – GDPR, for the following purposes:

a) ensuring the proper functioning of the website;

b) improving performance;

c) ensuring service security;

For the purposes of European privacy law, ‘cookies’ and similar tracking technologies are tools that store or access information on a user’s device to provide certain functions. These may include features such as session management, analytics or personalised advertising. Where such technologies are used, consent is obtained in accordance with applicable law.

2.3 Marketing Communications and Legal Basis

If ShoppyWhere needs to process email addresses collected for other purposes (e.g., transactional or service communications), such processing will be limited to what is necessary for the performance of those services and will not include promotional content unless separate consent has been obtained.

2.4 Cookies, statistics and session recordings on the website

The website uses the following technologies, described in detail in the Cookie Policy:

• necessary storage in the user’s browser (sw-consent, which records the cookie choices, and sw-app-bar-dismissed, which records that the App download bar was closed), processed on the basis of ShoppyWhere’s legitimate interest in the proper functioning of the website (Art. 6, par. 1, lett. F - GDPR);
• Google Analytics 4, provided by Google LLC, which measures how the website is used: pages visited, clicks on the links to the App and closing of the App download bar, together with technical data such as device and browser type;
• Microsoft Clarity, provided by Microsoft Corporation, which produces session recordings and heatmaps of how the pages of the website are used. Clarity is configured with the “Balanced” masking mode, which masks sensitive fields.

Google Analytics 4 and Microsoft Clarity are used only with the user’s consent (Art. 6, par. 1, lett. A - GDPR), given through the cookie banner. Without consent, neither tool is loaded. The website uses Google Consent Mode: storage and use of data for advertising purposes always remain denied, and Google Signals is disabled.

The user may withdraw consent at any time through the Cookie settings link, also available at the bottom of every page, without affecting the lawfulness of processing based on consent before its withdrawal.

Personal data collected through the website may be disclosed to the following parties:

• Technical and cloud service providers
  • Vercel Inc., hosting provider of the website, which processes the data referred to in point 2.2 in its server logs;
  • Aruba S.p.A., provider of the mailboxes req@shoppywhere.com and staff@shoppywhere.com, which receive the messages referred to in point 2.1;
  • Google LLC, provider of Google Analytics 4, only with the user’s consent;
  • Microsoft Corporation, provider of Microsoft Clarity, only with the user’s consent.
• Other recipients

  Personal data may be disclosed, within the limits provided by law, to:

  • Competent authorities, in cases required by regulatory or legal obligations;
  • Professionals or consultants appointed to provide legal, tax or accounting support services.

The above-mentioned entities act as Data Processors pursuant to Art. 28 of Regulation (EU) 2016/679 - GDPR, or operate independently as separate Data Controllers.

Personal data may be transferred outside the European Economic Area (EEA). In particular, certain processing activities may involve the transfer of data to the United States, to service providers adhering to the EU–U.S. Data Privacy Framework, as recognized by the European Commission Adequacy Decision of 10 July 2023.

The website uses the following service providers established in the United States: Vercel Inc., Google LLC and Microsoft Corporation. All of them are listed as active participants in the EU–U.S. Data Privacy Framework and in its UK Extension on the official Data Privacy Framework List (dataprivacyframework.gov). Aruba S.p.A. is established in Italy, within the European Union.

Processing is carried out in automated form using methods and tools aimed at ensuring maximum security and confidentiality, by duly authorized personnel.

No automated decision-making processes producing legal or similarly significant effects on the data subject pursuant to Art. 22 GDPR are carried out.

Any profiling activities for marketing purposes are carried out exclusively subject to the user’s prior consent.

In accordance with Art. 5, paragraph 1, lett. e) of Regulation (EU) 2016/679, personal data collected will be retained in a form that allows identification of data subjects for no longer than necessary to achieve the purposes for which the data are processed.

In particular:

• Messages sent through the contact form or by email are retained for the time necessary to respond to the request and, in any case, for no longer than 24 months.
• Google Analytics 4 event data are retained for 14 months.
• Microsoft Clarity data are retained for the periods indicated by Microsoft: 30 days for session recording playback data, and 9 months for click and heatmap data and for sessions labeled or marked as favorites.
• Server logs are retained by the hosting provider for a limited period, according to the configuration of the hosting plan.
• The user’s cookie choices are stored in the user’s browser for 6 months.

Provision of personal data for the purposes referred to in point 2.1 a) of this document is necessary for the provision of the services offered in the website; refusal to provide such data makes it impossible to fully use the website services.

Consent to the use of Google Analytics 4 and Microsoft Clarity referred to in point 2.4 is optional.

Refusal or subsequent withdrawal of consent does not prevent use of the website and does not affect the contractual or legal purposes described above.

The data subject may exercise the rights provided for by Articles 15, 16, 17, 18, 19 and 20 of Regulation (EU) 2016/679 by contacting the Data Controller at the email address: staff@shoppywhere.com.

In particular, the data subject has the right to obtain from the Data Controller access to personal data, rectification or erasure thereof, restriction of processing, as well as to object at any time to the processing of personal data concerning them (including automated processing such as profiling). The data subject also has the right to data portability.

Without prejudice to any other administrative or judicial remedy, if the data subject considers that the processing of personal data infringes Regulation (EU) 2016/679, they have the right to lodge a complaint with the competent supervisory authority in their Member State pursuant to Art. 77 GDPR.

In the event of a portability request, the Controller will provide personal data in a structured, commonly used and machine-readable format pursuant to Art. 20 of Regulation (EU) 2016/679, subject to the limitations set out in paragraphs 3 and 4 of the same article.

Shoppywhere LLP is established in the United Kingdom. For users in the United Kingdom, personal data are also processed in accordance with the UK GDPR and the Data Protection Act 2018. Such users have the rights described in point 8 and may lodge a complaint with the Information Commissioner’s Office (ICO).

Depending on where the user lives, local law may grant additional rights, for example under US state privacy laws such as California’s, the Australian Privacy Principles (Privacy Act 1988), or the data protection laws of the United Arab Emirates and Saudi Arabia. ShoppyWhere does not sell or share personal information for cross-context behavioural advertising, and the statistics tools of the website are used only with the user’s consent. Such rights may be exercised by writing to staff@shoppywhere.com. In Australia, users may also lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

The website is not directed at children under 16, and ShoppyWhere does not knowingly collect their personal data.

The website is served over HTTPS, and access to personal data is limited to duly authorized personnel. No method of transmission over the internet is completely secure.

ShoppyWhere may update this privacy policy. The “Last updated” date at the top of this page shows the latest version. If new tools or purposes requiring the user’s consent are added to the website, consent will be requested again through the cookie banner.