Notice on the processing of personal data under EU Regulation 2016/679 (GDPR) GDPR
The controller of your personal data is:
luiter.it only processes data you provide voluntarily. There is no sign-up form and no online payment: the order is recorded by the site and then completed over WhatsApp.
| Type of data | How it is collected | Where it is stored | Purpose |
|---|---|---|---|
| Products, quantities, total, language, order code | When you press “Order on WhatsApp” | Cloudflare D1 database (EU) | Recording and handling the order |
| IP address in irreversibly hashed form | Automatically, when an order is sent and on admin login attempts | Cloudflare D1 database (EU) | Abuse limits and security |
| Phone number | WhatsApp conversation you start | Cloudflare D1 database (EU), entered manually by the controller | Order handling |
| Name (optional) | WhatsApp conversation | Cloudflare D1 database (EU), entered manually by the controller | Personalised communication |
| Shipping address | WhatsApp conversation | Cloudflare D1 database (EU), entered manually by the controller | Order fulfilment |
| Cart and preferred language | Use of the site | Browser localStorage | User experience — client side only |
localStorage and are not sent to any server. When you place the order the site sends its database only products, total and language: name, phone and address never leave the site — you give them yourself on WhatsApp.
| Purpose | Legal basis (GDPR) |
|---|---|
| Handling orders via WhatsApp | Art. 6(1)(b) — performance of a contract |
| Replying to enquiries | Art. 6(1)(b) — pre-contractual measures |
| Tax and accounting obligations | Art. 6(1)(c) — legal obligation |
| Protecting the site from abuse (order limits, admin lockout) | Art. 6(1)(f) — legitimate interest in security |
| Improving the site (analytics) | Art. 6(1)(a) — consent, where applicable |
Personal data is kept only as long as needed for the purposes it was collected for:
Personal data is never sold or transferred to third parties. It may only be shared with:
Order data is stored in the European Union. Any transfer to third countries by the providers above takes place under the Standard Contractual Clauses approved by the European Commission.
Under Articles 15–22 GDPR you have the right to:
To exercise your rights write to info@luiter.it. We reply within 30 days.
You also have the right to lodge a complaint with your national data protection authority, or with the Italian Garante per la protezione dei dati personali.
The site uses strictly necessary technical storage only:
| Name | Type | Purpose | Duration |
|---|---|---|---|
luiter_cart | localStorage | Keeps the cart | Permanent (client side) |
luiter_cart_ts | localStorage | Expiry of the saved cart | Permanent (client side) |
luiter_lang | localStorage | Preferred language | Permanent (client side) |
There are no profiling cookies, third-party analytics or social media cookies without prior consent.
The site is served exclusively over encrypted HTTPS/TLS. No payment data is stored: transactions, where they happen, take place on certified third-party platforms (e.g. PayPal, Stripe).
Orders can only be viewed by the controller, through a password-protected panel. The panel logs every login attempt and automatically blocks anyone who gets the password wrong repeatedly. IP addresses are never stored in clear text, only in irreversibly hashed form.
The controller may amend this notice at any time. Changes take effect when published on the site. Please check this page from time to time.
Last updated: September 2026
For any question about this notice or about the processing of your personal data: