Privacy policy

This Privacy Policy, provided pursuant to Article 13 of Regulation (EU) 2016/679 (“GDPR” or the “Regulation”), explains how Users’ Personal Data (meaning any information capable of identifying them directly or indirectly) will be processed when they visit and/or make purchases on www.veobabys.com (the “Website”). This Privacy Policy, together with the Cookie Policy and the Terms of Use and General Terms and Conditions of Sale, sets out the basis on which Users’ Personal Data will be processed.

Personal Data Controller

The Data Controller for Personal Data collected through the Website is EPM STUDIO S.R.L. (the “Seller” or “VEO”), with its registered office at Via Arnaldo da Brescia no. 9, 70022 Altamura (BA), Italy, VAT number08721020728, REA registration number BA-645548 (the “Data Controller” or “Controller”). Email address: info@veobabys.com.

How Personal Data Is Processed

We place the utmost importance on our Users’ right to privacy and the protection of their Personal Data, which will be processed lawfully.

Personal Data provided or collected will be processed in accordance with the principles of fairness, lawfulness, transparency and confidentiality under applicable legislation, using appropriate security measures to prevent unauthorised access, disclosure, alteration or destruction of Personal Data. These security measures include an SSL certificate and the HTTPS protocol to protect the Personal Data entered and prevent access by unauthorised third parties.

Processing is carried out using IT and/or electronic communication tools, with organisational procedures and methods strictly related to the purposes indicated.

Personal Data Processed

When Users visit the Website, contact us (by email, telephone, post, etc.), subscribe to the newsletter or place an order, we process certain Personal Data, either directly or through third parties.

The categories of Personal Data processed are listed below:

  • Identification, contact and access details: first and last name, tax identification number (optional), email address, shipping address, telephone number and any other Personal Data voluntarily provided by the User.
  • Purchase data: information relating to purchases made.
  • Browsing data: connection information, IP addresses, domain names and other parameters relating to the browser and operating system used.
  • Usage Data: information generated when visiting or making purchases on the Website, including log data, registration data, interaction and transaction processes, performance indicators, browsing flow data and information about the use of features.
  • Billing data: where the User requests an invoice.

Purposes of Processing and Legal Basis

The Controller will process Users’ Personal Data, as listed above, in the course of its business and commercial activities for the specific purposes set out below.

Purposes Relating to the Contract and Legal Obligations

  • Enabling browsing on the Website.
  • Carrying out activities necessary to enter into and perform the contract for the purchase of products sold through the Website.
  • Processing orders.
  • Providing support and customer care, and responding to Users’ requests, complaints, reports and disputes submitted by email to the Controller’s addresses or through other communication channels.
  • Managing Users’ requests through remote communication tools, such as email, chat, telephone, SMS, chatbots, banners, notification systems and other remote communication tools available on the Website.
  • Complying with obligations arising from applicable laws, regulations or EU legislation, such as tax and accounting obligations, or managing and responding to requests from the competent administrative, tax and judicial authorities.
  • Carrying out administrative, accounting and tax activities connected with contracts entered into through the Website, such as issuing receipts and/or invoices and maintaining accounting records.
  • Responding to requests to exercise the rights granted to Users under their contract with the Controller, under the laws applicable to that contract or under the GDPR, and carrying out related activities.

For these purposes, the legal basis is the necessity to fulfil pre-contractual and contractual obligations to which the User is a party (Article 6(1)(b) GDPR) or to comply with legal obligations to which the Controller is subject (Article 6(1)(c) GDPR).

Processing is therefore necessary to enable the conclusion and performance of a contract through the Website or to respond to pre-contractual requests made by the User in relation to the Website. Failure to provide the data will consequently prevent the User from entering into a contract through the Website and/or receiving a response to their requests.

Analytics, Statistical and Other Purposes Not Based on Consent

  • Performing statistical analyses of Website use, browsing and product searches to improve the Website and the range of products sold through it.
  • Ensuring that the Controller’s contractual rights are respected, or demonstrating that obligations arising from the contract with the data subject or imposed by law have been fulfilled, and preventing and/or stopping fraudulent or harmful activities.
  • Reminding Users who have started the purchasing process that they have added a product to their shopping cart.

The legal basis for this processing is legitimate interest (Article 6(1)(f) of the Regulation). In certain cases, the legal basis is legitimate interest under Article 6(1)(f), read together with Recital 47 of the Regulation, for sending transactional emails, such as abandoned cart emails.

Direct Marketing and Profiling Purposes

  • With the User’s consent, we will send commercial emails containing updates, news, offers, promotions and market research, including through automated processing tools such as email and newsletters.
  • With the User’s consent, we will process their Personal Data to identify particular characteristics and preferences and send personalised and differentiated commercial communications based on their profile, including through automated processing tools such as retargeting or by placing them in groups of individuals with shared characteristics.

For this purpose, processing, including the final decision regarding the promotional communication to send or display to the User based on the group or groups to which they belong, is carried out automatically, without human intervention, using algorithms with previously configured parameters.

The legal basis is the User’s express consent to the processing of Personal Data for this purpose (Article 6(1)(a) of the Regulation). Providing data for this purpose is optional. Refusing or withdrawing consent, or exercising the right to object, will not in any way affect the User’s ability to make purchases on the Website.

Soft Spam

We may send commercial communications to the email address provided by the User when purchasing products through the Website, offering similar products for direct sale. This activity does not require the data subject’s prior express consent, as its legal basis is Article 130(4) of the Italian Privacy Code (Legislative Decree no. 196 of 30 June 2003), which expressly permits it, provided that the User does not object to such use, either initially or in subsequent communications.

Changing Your Preferences and Withdrawing Consent

Where consent has been given, the User may withdraw it at any time and/or object to the processing of Personal Data for general marketing and profiling purposes using the methods described in the “Data Subjects’ Rights” section below.

Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal. If the User withdraws consent and/or objects to processing for general marketing purposes, their data will no longer be processed for that purpose and will only be retained by the Controller where another legal basis justifies its processing, such as performance of a contract, a legal obligation or legitimate interest.

Retention Period

The Controller will process Users’ Personal Data for as long as necessary to achieve the purposes for which the data was collected, as defined in this Privacy Policy. For each of the purposes indicated, the Personal Data collected will be retained for the periods specified below:

  • For contractual purposes: the Controller will process the User’s data for the time strictly necessary to carry out each processing activity. Once that period has expired, the Controller may retain the data for the purposes and maximum retention periods specified in the other sections of this Privacy Policy, where relevant, and/or in the cases provided for by the GDPR and/or applicable law.
  • For tax, administrative, accounting and legal purposes: until the expiry of the statutory deadlines for fulfilling each obligation and/or for the retention periods required by law.
  • For purposes based on the Controller’s legitimate interest: the Controller will process the User’s data for the time strictly necessary to fulfil that interest. However, in the event of disputes and/or complaints, the Controller may need to retain Personal Data for legal defence purposes (point k) for the following 10 years, corresponding to the limitation period. In the event of litigation, further retention will depend on the duration of the proceedings or specific requests from the authorities. Users may obtain further information about the legitimate interest pursued by contacting the Controller.
  • For marketing and profiling purposes: until consent is withdrawn and, in any event, for a period of five years from the date on which the User gives or renews consent.

Once these retention periods have expired, Personal Data will be deleted, and the User will no longer be able to exercise the rights of access, erasure, rectification and data portability.

Disclosure and Dissemination of Data

In addition to the Controller, the following parties may, in certain circumstances, have access to the data:

  • Third parties performing ancillary and supporting tasks in relation to the Controller’s activities and processing Personal Data on the Controller’s behalf, such as payment service providers, lawyers, accountants, system administrators, logistics companies, logistics management service providers, newsletter service providers and manufacturers carrying out product repairs.
  • Public or private entities that may access the data under applicable laws, regulations and measures issued by competent authorities.
  • Potential purchasers of the Controller’s company and entities resulting from a merger or any other form of corporate restructuring.

Depending on the circumstances, these recipients process Users’ Personal Data as authorised persons, data processors or independent data controllers. Users may request an updated list of the data processors appointed under Article 28 GDPR.

Place of Processing and Transfers of Data Abroad

Data is processed primarily in Italy and other European Union countries. Certain third-party tools may process the Personal Data of Users of this Website in countries outside the European Economic Area (“Third Countries”).

Data transfers to Third Countries may also occur through the use of external tools that enable certain services, such as statistical analysis, newsletters, remarketing, advertising and social media buttons.

In some cases, the use of these tools may involve transferring the Personal Data of Users visiting this Website to a Third Country, such as the United States, for which there is no European Commission adequacy decision.

Should it become necessary to transfer data to Third Countries, the Controller undertakes to ensure that the country receiving the data provides an adequate level of protection, as required by Article 45 GDPR. Such transfers will be governed by the standard contractual data protection clauses approved by the European Commission for transfers of personal information outside the EEA, pursuant to Article 46(2) GDPR.

Cookies

This Website uses cookies. Cookies are small text files that websites may install on Users’ devices to make browsing more efficient, personalise content and advertisements, provide social networking features and analyse traffic. For further information, please read the Cookie Policy.

Personal Data Processing Tools

Contact Form

By completing the contact form, the User consents to the processing of the Personal Data entered and its use to respond to requests for information. The Personal Data processed includes the information requested in the form and any other Personal Data the User includes in the message.

Newsletters and Direct Marketing

The newsletter service allows the Controller to email Users commercial communications, promotions, updates on new products and similar content. Email addresses are managed through a database containing Users’ email addresses. Users are added to the mailing list when they subscribe to the newsletter and consent to receiving commercial communications, or when they make a purchase, in the case of soft spam.

In both cases, Users may unsubscribe from the newsletter using the relevant button included in the emails. Following an unsubscribe request, the User’s data will be deleted from the database of the software used by the Website to send newsletters.

The Personal Data processed by this service includes first name, last name, email address, shipping address, billing address, tax identification number (optional), payment information and telephone number. However, the software used by the Website to send newsletters may also process data relating to the date and time a message is viewed or clicks on links included in the message.

This Website uses the following email delivery service:

Klaviyo (Klaviyo Inc.)

Klaviyo is an email address management and message delivery service provided by Klaviyo Inc. To use Klaviyo’s service, the Controller generally shares information about Users who make purchases, such as contact details and purchase history. For further information about the scope of this sharing, please refer to the information under “Personal Data processed” below.

Personal Data processed: name and email address.
Place of processing: United States – Privacy Policy – Opt out.

LoopMe (LoopMe Ltd)

LoopMe is an advertising service provided by LoopMe Ltd.

Personal Data processed: Usage Data; Trackers.
Place of processing: United Kingdom – Privacy Policy – Opt out.

VIADS ADVERTISING (VIADS ADVERTISING S.L.)

VIADS ADVERTISING is an advertising service provided by VIADS ADVERTISING S.L.

Personal Data processed: Usage Data; Trackers.
Place of processing: Spain – Privacy Policy.

Viralize (Viralize Srl)

Viralize is an advertising service provided by Viralize Srl.

Personal Data processed: Usage Data; Trackers.
Place of processing: Italy – Privacy Policy – Opt out.

Social Media Buttons

Users may use social media buttons to visit the Website’s social media pages through the following social media tools. These tools also collect Users’ Personal Data, such as traffic data relating to the pages visited on which they are installed.

The Website provides the following social media buttons:

Instagram (Meta Platforms Ireland Limited)

The Instagram button is a service for interacting with the Instagram social network, provided by Meta Platforms Ireland Limited.

Personal Data collected: Cookies, Usage Data and other data as specified in the relevant privacy policy.
Place of processing: Ireland – United States – Privacy Policy.

Facebook (Meta Platforms Ireland Limited)

The Facebook button and social widgets are services for interacting with the Facebook social network, provided by Meta Platforms Ireland Limited.

Personal Data collected: Cookies and Usage Data.
Place of processing: Ireland – United States – Privacy Policy.

TikTok (TikTok Technology Limited)

The TikTok button and social widgets are services for interacting with the TikTok social network, provided by TikTok Technology Limited.

Personal Data collected: Cookies and Usage Data.
Place of processing: Ireland – Privacy Policy.

Place of processing: Ireland – Privacy Policy.

Pinterest (Pinterest, Inc.)

The Pinterest button and social widgets are services for interacting with the Pinterest social network, provided by Pinterest, Inc.

Personal Data collected: Cookies and Usage Data.
Place of processing: United States – Privacy Policy.

Analytics

Analytics services allow the Controller to monitor and analyse traffic data and track User behaviour. This Website uses the following third-party services:

Google Analytics (Google Ireland Limited)

Google Analytics is an analytics service provided by Google Ireland Limited. Google uses the Personal Data collected to track and examine the use of this Website, compile reports and share them with other services developed by Google. Google may use Personal Data to contextualise and personalise advertisements within its advertising network.

Google may also transfer this information to third parties where required by law or where those third parties process the information on Google’s behalf. IP address anonymisation is enabled on this Website. The IP address transmitted by the browser for purposes related to Google Analytics will not be combined with other data already held by Google.

In some cases, the use of Google Analytics may involve transferring the Personal Data of Users visiting this Website to a Third Country, such as the United States, for which there is no European Commission adequacy decision.

Google provides a browser add-on to disable Google Analytics at the following link: https://tools.google.com/dlpage/gaoptout?hl=it.

Personal Data collected: Cookies, IP address, Usage Data and other Personal Data specified in Google’s privacy policy.
Place of processing: Ireland and, in certain cases, the United States – Privacy Policy.

Hotjar (Hotjar Ltd.)

Hotjar is an analytics service provided by Hotjar Ltd. It also identifies the areas of this Website with which Users interact most frequently.

Personal Data processed: Usage Data; Trackers.
Place of processing: Malta – Privacy Policy – Opt out.

Lucky Orange (Lucky Orange, LLC)

Lucky Orange is an analytics service provided by Lucky Orange, LLC. It also identifies the areas of this Website with which Users interact most frequently.

Personal Data processed: clicks; Usage Data; scrolling interactions; mouse movements; relative scroll position; Trackers.
Place of processing: United States – Privacy Policy.

Remarketing

These services allow this Website to communicate, optimise and display advertisements based on the User’s past use of the Website. This activity is carried out by tracking Usage Data and using Cookies.

This Website uses the following services:

Facebook Remarketing (Meta Platforms Ireland Limited)

Facebook Remarketing is a remarketing and behavioural targeting service provided by Meta Platforms Ireland Limited (“Meta”), which connects activity on this Website with Meta’s advertising network.

This Website uses the Facebook Pixel to measure conversions. The Facebook Pixel helps us understand the actions people take on the Website. The data collected may be used to ensure that advertisements are shown to the right people, create audiences for advertisements and use additional advertising tools offered by the platform on which the advertisements are displayed.

The information collected is anonymous to the operators of this Website and cannot be used by them to identify individual Users. However, this information is stored and analysed by Facebook, which may link an action to an individual profile and use the information for advertising purposes within Facebook, as described in Facebook’s privacy policy. This enables Facebook to display advertisements both on Facebook and on third-party websites.

The Website Controller has no control over how this data is used. For further information on how Users can protect their privacy, please refer to Facebook’s Privacy Policy.

Place of processing: Ireland and the United States.

Google Ads (Google Ireland Limited)

Google Ads is a service provided by Google Ireland Limited that connects this Website with Google’s advertising network.

This Website uses Google Analytics remarketing features combined with Google Ads cross-device capabilities. This functionality allows target audiences for promotional campaigns created through the Google Analytics marketing feature to be linked to Google Ads cross-device capabilities.

This enables advertisements to be displayed based on Users’ personal interests, identified through an analysis of their online behaviour, whether on a mobile device or other devices.

Targeting and remarketing features can be permanently disabled by turning off “personalised advertising” in the User’s Google account. To do so, follow the opt-out link.

Personal Data collected: Cookies and Usage Data.
Place of processing: Ireland – Privacy Policy – Opt out.

Facebook Pixel (Meta Platforms Ireland Limited)

This Website uses the Facebook Pixel, a Facebook conversion tracking tool provided by Meta Platforms, Inc. It analyses conversions attributable to sponsored advertisements on Facebook through the use and analysis of certain Personal Data belonging to the User.

Personal Data collected: Cookies; Usage Data.
Place of processing: Ireland and, in certain cases, the United States – Privacy Policy.

TikTok Remarketing

This Website uses TikTok Remarketing, a TikTok conversion tracking tool provided by TikTok Inc. or TikTok Technology Limited.

Personal Data processed: Usage Data; unique device identifiers for advertising, such as Google Advertiser ID or IDFA; device information; Trackers.
Place of processing: Ireland – Privacy Policy.

Payment Processing

This Website uses the following third-party tools to process payments for orders:

PayPal (Paypal Europe S.à.r.l. et Cie, S.C.A Inc.)

PayPal is a payment service provided by PayPal Europe S.à.r.l. et Cie, S.C.A Inc., which allows Users to make online payments using their PayPal credentials.

Personal Data collected: Cookies and various types of data as specified in the service’s privacy policy.
Place of processing: Luxembourg – Privacy Policy.

Stripe (Stripe Payment Europe Limited)

Stripe is a payment service provided by Stripe Payments Europe, Ltd., which allows Users to make online payments using their Stripe credentials.

Personal Data collected: various types of data as specified in the service’s privacy policy.
Place of processing: United States – Privacy Policy.

Payment in Three Instalments through KLARNA

Payment in three instalments through KLARNA is a payment service offered by KLARNA Bank AB, a financial technology company providing online financial services such as post-purchase payments.

Personal Data collected: Cookies and various types of data as specified in the service’s privacy policy.
Place of processing: Sweden – Privacy Policy.

Apple Pay (Apple Payments Inc.)

Apple Pay is a non-instant mobile payment tool created by Apple Inc.

Personal Data collected: Cookies and various types of data as specified in the service’s privacy policy.
Place of processing: United States – Privacy Policy.

Shop Pay (Shopify Inc.)

Shop Pay is an accelerated payment service provided by Shopify Inc., which allows customers to save their email address, credit card details, and shipping and billing information.

Personal Data collected: Cookies and various types of data as specified in the service’s privacy policy.
Place of processing: Canada – Privacy Policy.

Google Pay (Google LLC)

Google Pay is a digital wallet system developed by Google LLC.

Personal Data collected: Cookies and various types of data as specified in the service’s privacy policy.
Place of processing: European Economic Area – United States – Privacy Policy.

Security Measures

This Website uses security measures designed to prevent unauthorised access, disclosure, alteration or destruction of Personal Data. These measures include an SSL certificate and the HTTPS protocol to protect the Personal Data entered and prevent access by unauthorised third parties.

Google reCAPTCHA (Google Ireland Limited)

This Website uses Google reCAPTCHA, a service provided by Google Ireland Limited that protects the Website against spam and abusive use by bots.

The service verifies that the User is a person rather than a bot by displaying text- or image-based challenges. In some cases, it uses a JavaScript element in the source code to analyse the User’s behaviour and actions to rule out bot activity without displaying challenges.

For further information about the data collected by the application, please consult the relevant Privacy Policy and Terms of Service.

Live Chat

WhatsApp (Meta Platforms Ireland Limited)

Users may use live chat through WhatsApp to access support or customer care services before, during and after a purchase.

The service is provided by Meta Platforms Ireland Limited and may use various technologies to collect and store information when Users use services with which it is integrated. This may include cookies and similar tracking technologies.

Place of processing: Ireland – Privacy Policy.

Tracking Pixels in Email Communications

Our promotional emails may contain tracking pixels, which are small, invisible images that allow us to detect whether you have opened a message, and tracking links that allow us to identify which content you have clicked on.

We use this information, together with your IP address and other technical data collected automatically during this process, to personalise the content we send you, adjust the frequency of our communications and measure the effectiveness of our campaigns.

We process this data on the basis of your consent, which you provide when subscribing to our promotional communications. You may withdraw your consent at any time, in whole or in part, through the “Manage Your Preferences” page, accessible via the link included in every email we send. Partial withdrawal allows you to continue receiving our communications without being tracked.

We use Klaviyo Inc. to send and technically manage these communications. Klaviyo acts as a data processor under a specific agreement pursuant to Article 28 GDPR.

Profiling and Automated Personalisation

We use automated tools integrated into our email marketing platform to personalise your experience and the communications we send you.

In particular, based on your browsing, purchase and communication interaction data, we automatically calculate indicators such as the expected value of our commercial relationship over time, the estimated likelihood and timing of your next purchase, the likelihood that you will stop engaging with us, and affinity scores for specific product categories.

We use these indicators to:

  • Suggest products based on your browsing and purchase history.
  • Adjust the timing and frequency of our communications.
  • Create groups of recipients with similar interests or behaviours, such as dedicated communication sequences for customers who have not purchased for some time or programmes reserved for our most loyal customers.
  • Send you communications tailored to those groups.

These processing activities constitute profiling within the meaning of Article 4(4) GDPR. To the extent that they rely on data collected through tracking pixels and tracking links, processing is based on the same consent described in the “Tracking Pixels” section. Processing of additional browsing and purchase data is based on consent.

At present, these processing activities do not result in decisions that produce legal effects concerning you or similarly significantly affect you.

Under Article 21(2) and (3) GDPR, you have the right to object at any time, free of charge and without giving reasons, to profiling carried out for these direct marketing purposes. You may exercise this right by writing to info@veobabys.com. You do not need to provide any reasons for exercising this right.

Data Subjects’ Rights

Data subjects are entitled to exercise the rights provided for in Articles 7 and 15–22 of the Regulation.

In particular, Users have the right to obtain:

  • Access to, updating and rectification of their data or, where they have an interest in doing so, completion of incomplete data.
  • Erasure, anonymisation or blocking of data processed in breach of the law, including data whose retention is unnecessary for the purposes for which it was collected or subsequently processed.
  • Confirmation that the above actions, including their content, have been notified to those to whom the data was disclosed or disseminated, unless this proves impossible or involves a manifestly disproportionate effort in relation to the right being protected.

Users also have the right to withdraw consent at any time where processing is based on consent; request data portability, meaning receipt of all Personal Data concerning them in a structured, commonly used and machine-readable format; request restriction of processing and/or erasure of Personal Data (the “right to be forgotten”); and object to the processing of their Personal Data, including processing for the purposes of sending advertising material, direct selling and conducting market research.

Under applicable legislation, the Controllers inform Users that they have the right to obtain information about:

  1. The source of the Personal Data.
  2. The purposes and methods of processing.
  3. The logic applied where processing is carried out using electronic tools.
  4. The identity of the Controllers and processors.
  5. The parties or categories of parties to whom Personal Data may be disclosed or who may become aware of it as processors or authorised persons.

Data subjects may exercise their rights by sending a request to the Controller:

  • By email to info@veobabys.com.
  • Via WhatsApp at (+39) 350 969 3012.
  • Through the Contact section.

If data subjects believe that the processing of their data infringes the Regulation, they also have the right to lodge a complaint with the Italian Data Protection Authority, the supervisory authority for Personal Data protection: Garante per la protezione dei dati personali, Piazza Venezia no. 11, 00187 Rome, Italy (http://www.garanteprivacy.it/).

Changes to This Privacy Policy

The Controller reserves the right to amend this Privacy Policy at any time by notifying Users on this page. Users are therefore encouraged to consult this page frequently, referring to the date of the latest update shown at the bottom.

If a User does not accept the changes made to this Privacy Policy, they must stop using this Website and may ask the Controller to remove their Personal Data.

Unless otherwise specified, the previous Privacy Policy will continue to apply to Personal Data collected up to that point.

The Controller is not responsible for keeping all links displayed in this Privacy Policy up to date. Therefore, whenever a link is not working and/or is outdated, Users acknowledge and accept that they must refer to the relevant document and/or section of the websites referred to by that link.

Privacy Policy updated in May 2023.