How we handle your data.

1. Who handles your data

The data controller is Lorenzo De Vignani, Italian VAT number 04809150164.

For any request concerning your data you can write to lumixultra@gmail.com. We reply within thirty days, as the Regulation requires.

We have not appointed a Data Protection Officer (DPO) because none of the cases set out in Article 37 of the Regulation apply.

2. What data we collect

We only collect the data you write yourself, by filling in one of the two forms on the site. There is no other collection: we do not profile, we do not buy lists, we do not cross-reference your data with other sources.

Contact form

• Full name
• Email address
• Phone number, if you choose to leave one
• The text of the message you send us

Distributor application form

• Full name, company or practice
• Email and phone
• VAT number, if you enter one
• The area you cover and the type of business
• Expected sales volume and a description of your customer base

Please do not put special category data in your messages — health information, patient data, personal beliefs. We do not need it and we do not want to process it.

3. Why we process it and on what legal basis

We use the data from the contact form to reply to you: product information, quotes, support. The legal basis is your consent (Article 6(1)(a) of the Regulation), given by ticking the box before you send.

We use the data from the application form to assess a possible commercial partnership and to contact you back. The legal basis is your consent and the pre-contractual steps you yourself request (Article 6(1)(b)).

If a purchase arises from one of these contacts, we will process the data needed to issue the invoice and ship the product: in that case the legal basis becomes performance of the contract and compliance with legal obligations, in particular tax obligations.

We do not send you marketing messages unless you explicitly ask us to. Filling in the contact form does not subscribe you to any newsletter.

4. Who else sees your data

Your data is not sold, transferred or disclosed to third parties for marketing purposes. It only passes through the technical suppliers we need to run the site and the mail:

• Shopify International Ltd. — hosts the site and the shop, receives the form submissions and handles orders and payments. It is based in Ireland; where data reaches its companies outside the European Union, the transfer takes place on the basis of the Standard Contractual Clauses approved by the European Commission.
• Google Ireland Ltd. — runs the lumixultra@gmail.com mailbox where the form notifications arrive.

Both act as data processors. Our accountant and the advisers who assist us may also access the data where necessary, as may public authorities in the cases provided for by law.

5. How long we keep it

• Contact enquiries: twenty-four months from the last exchange, then we delete them.
• Distributor applications: twenty-four months from submission, or for the whole duration of the commercial relationship if the partnership goes ahead.
• Purchase and invoicing data: ten years, as Italian tax law requires.

You can ask us to delete it before these deadlines, except for what we are required by law to keep.

6. Cookies and measurement tools

This site does not use advertising profiling cookies: there is no Google Analytics and no Meta pixel.

Shopify, which hosts the shop, uses technical cookies needed to make it work — they keep your session open and remember what you put in the cart — and its own analytics cookies, which tell us in aggregate how many people visit the pages and where they stop. For the analytics cookies you are asked for consent on your first visit, and you can change your mind at any time.

The typefaces are hosted on our own servers and not on Google's: your IP address is not passed to any external supplier in order to display the pages.

Ordinary server logs are also recorded — IP address, date and time, page requested — kept for a short period for security and diagnostics. No consent is required for these, because they serve to deliver the service you asked for.

If we activate advertising or profiling tools in the future, this page will be updated beforehand and your consent will be asked for separately.

7. Your rights

At any time you can ask us to:

• Access the data we hold about you and receive a copy of it
• Correct anything wrong or incomplete
• Erase it (the "right to be forgotten")
• Restrict its processing
• Receive it in a readable format so you can take it elsewhere
• Object to the processing
• Withdraw your consent whenever you want, without this making what was done before unlawful

Write to lumixultra@gmail.com: it is free and we reply within thirty days.

If you believe your data is being handled improperly, you can lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali — garanteprivacy.it — or with the supervisory authority of the country where you live, or go to court.

8. Security

The site is served over HTTPS only: what you write in the forms travels encrypted. Access to the mailboxes and to the management panels is protected by passwords and two-step verification.

No measure is infallible: should a breach occur that puts your rights at risk, we will tell you and notify the supervisory authority within the time limits set by law.

9. Changes

If we change the way we handle data, we update this page and change the date at the top. It is worth checking back now and then.