Privacy notice

Seller

assistenza@ireshop.it

Controller and privacy contact

The controller is the seller identified on this page. Privacy requests may be sent to assistenza@ireshop.it. No data protection officer has been appointed because the current processing activities do not require one.

Data processed

We process details submitted through forms, live chat and checkout: name, contact details, address, country, order data, preferences, support requests and recorded choices.

For security and operation we may process minimised technical data such as a protected IP fingerprint, device type, timestamps, source page, session identifiers and events needed to prevent abuse.

Iré does not store full card, wallet or PayPal account credentials. Those details are entered in the payment provider’s secure interface.

Purposes and legal bases

Data is used to answer pre-contract requests, enter into and perform the contract, deliver goods and digital content, manage payments, returns, the statutory guarantee and support.

Legal obligations, accounting and the establishment or defence of claims rely on the applicable law. Essential security, fraud prevention and service improvement rely on legitimate interests after a proportionality assessment.

Newsletter messages, personalised reminders and non-essential tracking rely on separate, withdrawable consent. Supplying an email address for an order never subscribes a customer automatically.

Checkout and payments

Checkout may offer cards, wallets, PayPal and other methods available for the customer’s country, currency, device and account configuration. Iré receives only the result, technical references and data needed to match the payment to the order.

Apple Pay, Google Pay, Link and PayPal may display their own notices and act under their respective privacy roles. A method appears only when it is actually available for the transaction.

Marketing and email

Marketing remains pending until any required double opt-in is completed. After consent and voluntary session linking, viewed products, cart updates and a started checkout may be used for relevant reminders and offers. PDF guides are paid products and are never distributed as a marketing incentive.

Marketing events are kept for no more than 90 days. The standard setup does not place pixels in emails to measure opens or clicks.

Shop measurement and advertising

Only after “Accept all”, Microsoft Clarity may measure page use, Google tag GT-WV8WZ9XH may record visits and purchases attributed to Google, and Meta may measure the configured advertising events. These tools remain disabled with “Necessary only”.

Google Purchase is sent only after the server confirms payment. It contains the unique order number, value, currency, quantities and product SKUs, but no full card or payment-account details, and is deduplicated through transaction_id.

Google Customer Reviews

After a confirmed payment, the order-confirmation page shows every purchaser the optional Google Customer Reviews opt-in. It is separate from analytics and advertising consent: declining it does not affect the order, support or delivery.

Only when the customer chooses to participate are their email address, order number, delivery country and estimated delivery date shared with Google. Google may then send the survey after that date and processes the data under its own terms and privacy notices.

Instagram gallery

The home page may display content published by the professional account @irehandwovenbags. Text and images are fetched server-side and images are delivered through an Iré proxy, so merely viewing the gallery does not connect the visitor’s browser directly to Instagram or install advertising cookies from the social network.

Opening a post or profile takes the visitor from Iré to Instagram, where Instagram’s notices and settings apply. The gallery is separate from any future advertising setup.

Live chat and online withdrawal

Live chat processes name, email, messages, source page, timestamps and minimised technical data to answer and prevent abuse. Chat consent is not marketing consent.

The online withdrawal function records the information needed to identify the declaration, the order reference, receipt time and the customer’s chosen contact details.

Recipients and transfers

Data may be shared as necessary with hosting and security providers, payment services, email providers, carriers, technical support, advisers and competent authorities.

Transfers outside the EEA use an adequacy decision or recognised safeguards such as standard contractual clauses, together with the required assessments.

Retention

Chat conversations are normally deleted within 180 days of last activity. Order, payment, return and guarantee records are kept for the service and applicable legal periods, up to 10 years where required for administrative records or legal claims.

Contact data not linked to an order is kept only as long as needed to answer and handle any follow-up, then deleted or anonymised.

Rights and complaints

You may request access, correction, erasure, restriction, portability, objection and information about transfer safeguards. Consent may be withdrawn at any time without affecting earlier processing.

You may lodge a complaint with the Italian Data Protection Authority or the authority competent for your residence.