Privacy notice

This notice explains how your personal data is handled, as required by Articles 13 and 14 of the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Italian Privacy Code (Legislative Decree 196/2003).

Who is responsible

The data controller is Maeyke Kok – VIREBOOKS, Via del Pie Calato 9, Vellano, 51017 Pescia (PT), Italy (P.IVA IT07036030828). For anything about your personal data, e-mail mail@vire-books.com.

What this website collects, and why

Purchases. When you buy something, I process your name, e-mail address, shipping address, phone number (if you give it), what you bought and the payment confirmation. I need these to complete the sale, ship your order and handle returns or guarantee claims. Legal basis: the contract with you (Art. 6(1)(b) GDPR). I keep sales records for 10 years, because Italian tax and accounting law requires it (Art. 2220 Civil Code; Art. 6(1)(c) GDPR).

Customer account (optional). If you log in, your account stores your e-mail address, your orders, your wishlist and, after your first order, your shipping address so the payment page can be filled in for you. You log in with a one-time code sent by e-mail; there is no password. Legal basis: the contract with you (Art. 6(1)(b) GDPR). You can remove the saved address in your account at any time, and ask me to delete the whole account; order records are then kept only as long as the law requires.

Withdrawals and complaints. If you withdraw from a purchase or send a complaint, I keep what you send and the confirmation, to handle it and to be able to prove it was handled. Legal basis: legal obligation (Art. 6(1)(c) GDPR).

Contact form. When you send a message, I receive your name, e-mail address, the type of request, the item or book you mention and your message. I use this only to answer you and, for a custom order, to arrange it. Legal basis: your request (Art. 6(1)(b) GDPR). The form is delivered to my inbox through Web3Forms.

Newsletter. If you sign up, your e-mail address is stored by MailerLite so I can send you news about product drops and the studio. Legal basis: your consent (Art. 6(1)(a) GDPR). Every newsletter has an unsubscribe link, and you can also e-mail me to be removed.

Server logs. Like every website, the hosting provider briefly processes technical data such as your IP address and browser type to deliver pages and protect the site against abuse. Legal basis: legitimate interest in a secure website (Art. 6(1)(f) GDPR).

Cookies and local storage

This website uses only technical cookies, so no consent banner is needed (Art. 122 Italian Privacy Code; Art. 5(3) Directive 2002/58/EC; Garante guidelines on cookies of 10 June 2021):

• a login cookie, only if you log in to your account, to keep you logged in. While you're logged in, the IP address and browser of that login are stored with it, to protect your account; they're deleted when the login ends;
• a language cookie (vb-lang, one year), only if you switch the language, so the site remembers it;
• your browser's local storage, to remember your cart and the country you chose. This stays on your device;
• a statistics cookie (vb_vid, kept for up to 13 months) with a random code, so I can count how many people visit, which pages and products they look at, where they came from (the website that linked here) and whether they end up buying. I run these statistics myself, only for this website and only as totals: no IP address, name or e-mail is stored with them, and they're never shared with anyone or combined with other data. The Garante treats statistics cookies used this way like technical cookies. Legal basis: legitimate interest in knowing how the shop is used (Art. 6(1)(f) GDPR). You can delete or block the cookie in your browser at any time; the site works just the same.

No advertising, no tracking across other websites, no third-party analytics such as Google Analytics, and no social media trackers. Fonts are hosted on this site itself, so loading a page does not send your IP address to Google. Links to Instagram, TikTok, YouTube and Nerdy Vintage take you to those services, which have their own privacy policies.

Who processes your data

These companies process data on my behalf, under data processing agreements (Art. 28 GDPR):

• Cloudflare hosts the website and its photos and videos, and stores the visit statistics for me.
• Neon hosts the database in Frankfurt, Germany.
• Stripe processes payments. Stripe is also an independent controller for its own legal duties, such as fraud prevention and anti-money-laundering checks.
• Packlink (Spain) and the carrier it books (for example Poste Italiane, BRT, UPS) receive your name, address, phone number and e-mail to deliver your parcel.
• Resend sends order e-mails and login codes.
• Web3Forms delivers contact form messages by e-mail.
• MailerLite (based in Lithuania, EU) stores newsletter subscribers.

Some of these companies are based in the United States. Where data leaves the EU, they rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses (Art. 45–46 GDPR).

How long data is kept

• Sales records and invoices: 10 years.
• Customer account: until you ask me to delete it.
• Withdrawals and complaints: as long as the related sale record.
• Contact form messages: as long as needed to answer you, and deleted after two years at the latest unless they are part of a sale.
• Newsletter: until you unsubscribe.
• Checkouts that were started but never paid: your details are removed after 30 days.
• Logins: until you log out or the login runs out (60 days at most).
• Visit statistics: details for 3 months, after that only totals per day that can’t be traced back to anyone.

Your rights

You can ask to see, correct or delete your personal data, ask me to limit or stop using it, object to its use, ask for a copy in a portable format, and withdraw your consent at any time (Art. 15–22 GDPR). Just e-mail mail@vire-books.com. If you think your data is not being handled properly, you can complain to the Italian data protection authority, the Garante per la protezione dei dati personali (Art. 77 GDPR), or to the authority in the EU country where you live.

Giving your data is needed to buy something; without a name, address and e-mail address I cannot complete and ship an order. No decisions are made about you by automated means.