Privacy policy

Last updated: 31 August 2026.

This notice explains how DomShop (DOM vintage wholesale) handles the personal data of its customers and site visitors, under Regulation (EU) 2016/679 (GDPR).

The Italian version of this notice is the authoritative one. This translation is provided for convenience; where the two differ, the Italian text prevails.

Data controller

The data controller is DOM DI DOMENICO DE VIVO (trading as DomShop, DOM vintage wholesale).

Registered office: Via Lavinaio I Tratto, 12, 80044 Ottaviano (NA), Italy
VAT number: 10353781213
Email: info@domshop.it

The Controller determines the purposes and means of the processing of personal data under art. 4(7) GDPR.

For any request about your data, write to the address above or use the Contact page.

What we handle

Account data: first name, last name, email, phone, password (stored only in encrypted form, never readable, not even by us).
Order and shipping data: addresses, order contents, delivery status, tax documents.
Payment data: handled directly by the payment provider. Card numbers never pass through our servers and are never stored by us.
Video reviews: the video you upload and its technical data, published only after approval and only with your consent.
Support requests: the text of the messages you write to us and the subject of the request.
Chat with the automated assistant: what you write in the chat, plus your name and email if you are not signed in. The details are in the "Automated assistant (chat)" section.
Notifications: the technical address your browser assigns to your device, if you turn notifications on.
Technical data: what is needed to make the cart, the session and security work.
Visit data for statistics: the address of the page you open, where you came from, the type of browser, operating system and device, the language and the country. No cookies and nothing left on your device: the details are in the "Usage statistics" section.

Purposes and legal bases

Performance of the contract: managing accounts, orders, payments and shipping.
Legal obligations: tax and accounting duties.
Consent: video reviews, notifications, chat with the automated assistant and non-essential cookies. Consent can be withdrawn at any time, and withdrawing it does not affect what was done before.
Legitimate interest: site security, abuse prevention, aggregate usage statistics for the shop and recovering carts left half-finished.

Who we share data with

We do not sell your data and we do not pass it to anyone for third-party commercial purposes. We share it only with those we need to get you what you bought, and only as far as needed:

Payment provider (Stripe Payments Europe, Ltd.): receives what is needed to collect the order. It acts as an independent controller for the anti-money-laundering and anti-fraud duties the law imposes on it.
Couriers and shipping services: receive name, address and phone number, without which the parcel cannot be delivered.
The provider hosting our servers (Aruba S.p.A.): keeps the data on our behalf, as a processor, and cannot use it for itself. The servers are in the European Union.
Browser notification services (Google, Mozilla, Apple, Microsoft, depending on the browser you use): if you turn notifications on, they receive the message to deliver to your device. They do not receive your name or your email.
Email service provider: delivers the messages we send you: confirmations, reminders about a cart left half-finished, shipping proposals for orders abroad, replies from support. It receives your email address and the content of the message, and nothing else. It acts as a processor and cannot use the addresses for its own purposes.
Tax and accounting advisers: receive purchase documents, as tax law requires.
Authorities: only on formal request and in the cases the law provides for.

Each of these, when acting on our behalf, is appointed as a processor under a contract that forbids using the data for its own purposes.

Usage statistics do not appear in this list because they have no recipients: the program that collects them sits on our own server and sends nothing outside.

Transfers outside the European Union

Data is stored on servers located in the European Union. Some of the providers listed above belong to groups headquartered in the United States, and in those cases a transfer may occur:

Payment provider: the relationship is with the group's Irish company; any transfer to the US parent takes place under the Standard Contractual Clauses approved by the European Commission (decision 2021/914) and, where applicable, the EU-US Data Privacy Framework.
Browser notification services: delivery passes through the browser maker's infrastructure, which may sit outside the Union. The content travels encrypted and carries no identifying data.

You can ask us for a copy of the safeguards in place through the Contact page.

How long we keep it

Each category has a duration set by how long that data is still of use to someone. Once expired, it is deleted by an automatic procedure that runs every night: it is not a promise, it is code that executes.

Data	How long	Why
Orders and tax documents	10 years	Legal obligation (art. 2220 of the Italian Civil Code and tax law). They cannot be deleted earlier, not even on request.
Account data	Until you ask for erasure	It is what lets you find your orders and addresses again.
Cookie consent records	2 years	They are the proof that consent was given: deleting them sooner would mean being unable to demonstrate it.
Closed support requests	2 years	It is the length of the legal warranty, within which you can refer back to a past conversation.
Carts left half-finished	90 days	After three months the reminder makes no sense. Once the term expires both the reminder and the cart itself are removed, together with the email address and any shipping address filled in.
Record of messages sent	1 year	It is the proof that a message went out, to whom and when. Within the year a dispute about a missing communication is plausible; after that, only an email address is left.
Refused or expired export requests	1 year	Having never become orders, they have no tax value.
Notifications already read	6 months	A notification that has been read has served its purpose.
Questions to the automated assistant	6 months	They help us improve the answers; they are free text and may contain data written by mistake.
Chat conversation statistics	6 months	They tell us where conversations stop. They contain neither the text of the messages nor anything that identifies you.
Video reviews	Until you withdraw consent	They are published only with your consent, and they go when you take it back.
Usage statistics	14 months	Fourteen months are enough to compare a period with the same period a year earlier; beyond that, visit data no longer helps decide anything.

Your rights

You have the right of access, rectification, erasure, restriction, objection and data portability, as well as the right to withdraw consent at any time.

Two of these you can exercise on your own, right away, without asking anyone: from the My data page in your account you can download a file with everything we know about you and you can erase your account. Erasure immediately removes support requests, wishlist, notifications and video reviews, and makes your name, email and phone anonymous; only orders remain, which the law requires us to keep.

For the other rights, and for any question, write to us from the Contact page. We answer within one month, as article 12 GDPR requires.

If you believe the handling of your data breaches the Regulation, you can lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it) or with the authority of your own country.

Automated decisions

We do not take decisions concerning you based solely on automated processing, and we do not carry out profiling.

Minors

The site is aimed at professional buyers and is not intended for anyone under sixteen. We do not knowingly collect their data; if we find that we have, we delete it.

Security

Data travels encrypted, passwords are stored only in non-reversible form, uploaded files are held in an encrypted store, and access to systems is limited to those who must work on it. Should a breach occur that poses a risk to your rights, we will tell you and notify the Authority within the legal deadlines.

Automated assistant (chat)

The chat you find on the site is a rule-based assistant, not a generative artificial intelligence: it answers by following a guided path and a dictionary we wrote ourselves, and it runs on our own server. What you write is not sent to any external service, is not used to train any model, and does not leave our system.

Before you can write we ask for your consent, and without it the chat does not go on: the legal basis is your consent (art. 6(1)(a) GDPR). It is consent and not another basis because the chat is not something you need in order to buy (the shop works perfectly well without it) and because in a free-text field you can write anything at all: asking you first is the only correct way to open it. Your acceptance is recorded by our server with a signed proof, so what remains of that consent is when you gave it, not our word for it. You can withdraw it at any time: close the chat and write to us from the Contact page.

What we handle: what you write in the chat; your name and email, read from your account if you are signed in or asked in the chat if you are not, and only so that we can answer you; if you open a support request, also the subject, the order you point to and the page you were writing from.
Conversation statistics: we keep a count: a random identifier, the language, the shape of the page you opened the chat from, how far you got, how many messages, and whether a support request came out of it. It contains neither the text of the messages, nor your name, nor your email. It serves to understand where conversations stop.
Questions not understood: when the assistant does not understand, the phrase is kept in normalised form with one example, to improve the answers.
How long: conversation statistics and questions not understood, 6 months. If a support request comes out of the chat, it follows the timing for support requests given in the table above.
Who reads it: only those who run the shop, from the administration panel. External recipients: none, and no transfer outside the European Union.

No profiling and no automated decisions. The assistant does not build a profile of you, does not compare you with other users and takes no decisions concerning you: it only chooses which answer to show you based on the words you write. Article 22 GDPR therefore does not apply.

The chat is not the channel for special category data. We ask you not to write in the chat any data about health, judicial data, religious, political or trade-union beliefs, biometric data or other special categories under articles 9 and 10 GDPR: we do not need them, we do not ask for them, and the chat is not equipped to receive them. If you need to discuss such matters, use the Contact page.

Usage statistics

To know which pages get read and where the shop works badly we use Umami, a statistics program installed on our own server: the data stays here and is not shared with anyone.

It uses no cookies and leaves no identifier on your device, it does not profile you and it does not follow you from one site to another. That is why it does not go through the consent banner: the legal basis is legitimate interest (art. 6(1)(f) GDPR) in understanding how the shop is used, and it holds precisely because there is no price for you to pay: no cookies, no profile, no data passed to third parties.

What we record: the address of the page, the page you came from, the type of browser, operating system and device, the language and the country. The session is recognised by a fingerprint that changes every day, and your IP address is not kept in the clear.
What we do not record: whatever follows the question mark in the address is always cut off before sending, and three parts of the site never reach the statistics at all: the whole account area (the pages under /account), the shipping proposal for orders abroad and the shared wishlist. The last two because the address carries the code that protects the page, and recording it would mean handing it to the statistics. The cart and the checkout, on the other hand, are measured.
If you asked your browser not to be followed ("Do Not Track"), you are not counted at all.
Recipients: none, and no transfer outside the European Union. We keep this data for 14 months and then delete it: the reason is in the table above.

Cookies

Cookie use is described in the Cookie policy. You can manage consent from the "Cookie preferences" link in the footer.

The shop's statistics use no cookies: the program that collects them sits on our own server and leaves nothing on your device. The details are in the "Usage statistics" section above.

Changes

If we change this notice, we update the date at the top of the page. For changes affecting purposes or recipients we will let you know before they take effect.