Notice on the processing of personal data under EU Regulation 2016/679 (GDPR) GDPR
The controller of your personal data is:
luiter.pages.dev only processes data you provide voluntarily. There is no sign-up form and no online payment: the order is recorded by the site and then completed over WhatsApp.
| Type of data | How it is collected | Where it is stored | Purpose |
|---|---|---|---|
| Products, quantities, total, language, order code | When you press “Order on WhatsApp” | Cloudflare D1 database (EU) | Recording and handling the order |
| IP address in irreversibly hashed form | Automatically, when an order is sent and on admin login attempts | Cloudflare D1 database (EU) | Abuse limits and security |
| Phone number | WhatsApp conversation you start | Cloudflare D1 database (EU), entered manually by the controller | Order handling |
| Name (optional) and email address | Request form when email summaries are enabled, or WhatsApp conversation | Cloudflare D1 database; Resend for email sending when enabled | Handling the request and sending its summary |
| Shipping address | WhatsApp conversation | Cloudflare D1 database (EU), entered manually by the controller | Order fulfilment |
| Cart and preferred language | Use of the site | Browser localStorage | User experience — client side only |
localStorage until you submit a request. The site records products, quantities, total, language and reference. When email summaries are enabled, it also records the optional name and email entered in the form for communications about the request. Phone numbers and shipping addresses are supplied on WhatsApp. The email is not used for newsletters or advertising.
| Purpose | Legal basis (GDPR) |
|---|---|
| Handling orders via WhatsApp | Art. 6(1)(b) — performance of a contract |
| Replying to enquiries | Art. 6(1)(b) — pre-contractual measures |
| Tax and accounting obligations | Art. 6(1)(c) — legal obligation |
| Protecting the site from abuse (order limits, admin lockout) | Art. 6(1)(f) — legitimate interest in security |
| Improving the site (analytics) | Art. 6(1)(a) — consent, where applicable |
Personal data is kept only as long as needed for the purposes it was collected for:
Personal data is never sold or transferred to third parties. It may only be shared with:
Order data is stored in the European Union. Any transfer to third countries by the providers above takes place under the Standard Contractual Clauses approved by the European Commission.
Under Articles 15–22 GDPR you have the right to:
To exercise your rights write to enzopoleo93@gmail.com. We reply within 30 days.
You also have the right to lodge a complaint with your national data protection authority, or with the Italian Garante per la protezione dei dati personali.
The site uses strictly necessary technical storage only:
| Name | Type | Purpose | Duration |
|---|---|---|---|
luiter_cart | localStorage | Keeps the cart | Permanent (client side) |
luiter_cart_ts | localStorage | Expiry of the saved cart | Permanent (client side) |
luiter_lang | localStorage | Preferred language | Permanent (client side) |
There are no profiling cookies, third-party analytics or social media cookies without prior consent.
The site is served exclusively over encrypted HTTPS/TLS. No payment data is stored: transactions, where they happen, take place on certified third-party platforms (e.g. PayPal, Stripe).
Orders can only be viewed by the controller, through a password-protected panel. The panel logs every login attempt and automatically blocks anyone who gets the password wrong repeatedly. IP addresses are never stored in clear text, only in irreversibly hashed form.
The controller may amend this notice at any time. Changes take effect when published on the site. Please check this page from time to time.
Last updated: October 2026
For any question about this notice or about the processing of your personal data:
The contact form is prepared but sending is currently disabled. Once enabled, it processes an optional name, email, topic, message and a technical request identifier to forward the communication and allow a reply. There are no attachments or automatic replies.
Cloudflare hosts the site and shared service, applies security protections and manages abuse counters. The counter database records only the UTC day, site and technical identifier: it contains no name, email, message text or IP address. The active database retains approximately three days of counters; any backups follow the provider’s settings. Temporary IP protections use HMAC keys and do not write IP addresses to application logs.
Resend receives the data needed to forward the email. Google/Gmail handles receipt and correspondence in the destination mailbox. The email entered in the form may be used to reply. Resend acceptance does not confirm mailbox delivery. The service retains idempotency keys for 24 hours; every attempt, including failed attempts and retries, counts towards sending limits.
The form uses no CAPTCHA, advertising, analytics or session recordings. Fields are not saved to browser storage or a service worker cache; text stays only in the open page. This notice and the contact page load no analytics or advertising and are readable without consent scripts.
The controller’s full identity and contact details, the legal basis applicable to different requests, actual correspondence retention periods and provider agreements must be completed with the owner before sending is enabled. Order retention periods stated elsewhere do not automatically apply to form messages.