Privacy policy

PRIVACY NOTICE – CESARE GASPARI

Last revised: 26 October 2026

This Privacy Notice explains how Anneta Shoes S.L. ("we", "us", "our"), trading as Cesare Gaspari, collects, uses, shares and protects your personal data when you visit www.cesaregaspari.eu, buy from us, contact us or receive our communications. It applies to customers in the European Economic Area (EEA), the United Kingdom (UK), the United States (US), Switzerland and elsewhere. Section 12 contains additional information for US residents.

1. WHO WE ARE (DATA CONTROLLER)

- Controller: Anneta Shoes S.L. (trading as Cesare Gaspari), a company registered in Spain
- Tax ID (NIF / VAT): ESB67562801
- Registered address: Antic Camí Ral de València 38, local 15, 08860 Castelldefels, Barcelona, Spain
- Privacy contact: info@cesaregaspari.eu
- Lead supervisory authority: Agencia Española de Protección de Datos (AEPD), www.aepd.es

2. CUSTOMERS IN THE UNITED KINGDOM

When we sell to customers in the UK, we process their personal data in line with the UK GDPR and the Data Protection Act 2018, in addition to the EU GDPR and Spanish law. UK customers have the same rights described in this notice and can contact us at info@cesaregaspari.eu. UK customers can also complain to the Information Commissioner's Office (ICO) (see section 11).

3. THE PERSONAL DATA WE COLLECT

- Identity and contact data: name, email address, phone number, delivery and billing address.
- Order data: products bought, prices, order history, returns and refunds.
- Payment data: payments are processed by our payment providers (Shopify Payments and the other payment methods shown at checkout). We do not store your full card number; we only receive confirmation of payment and limited details such as the card type and last four digits.
- Customer service data: messages you send us by email, chat or contact form.
- Account data: login details and preferences, if you create an account.
- Marketing preferences: whether you have subscribed to our newsletter and how you interact with our emails.
- Technical and usage data: IP address, browser and device type, language, country, pages visited and how you use our website, collected through cookies and similar technologies (see section 8).

We do not process special category (sensitive) personal data.

4. WHY WE USE YOUR DATA AND OUR LEGAL BASIS

- Processing and delivering your order, returns and refunds: performance of a contract (Art. 6(1)(b)).
- Managing your customer account: performance of a contract (Art. 6(1)(b)).
- Customer service and answering your questions: performance of a contract; legitimate interests (Art. 6(1)(f)).
- Customs declarations, duties and import taxes for deliveries outside the EU (for example to the UK or the USA): performance of a contract; legal obligation (Art. 6(1)(c)).
- Invoicing, accounting and tax obligations: legal obligation (Art. 6(1)(c)).
- Fraud prevention and payment security: legitimate interests (Art. 6(1)(f)).
- Website security, operation and analytics: legitimate interests; consent for non-essential cookies.
- Newsletters and marketing emails: consent (Art. 6(1)(a)), or for existing customers, soft opt-in for similar products where the law allows; you can unsubscribe at any time.
- Personalised advertising and abandoned-cart reminders: consent.
- Exercising or defending legal claims: legitimate interests; legal obligation.

Our legal bases explained:

- Performance of a contract (Art. 6(1)(b) GDPR / UK GDPR): we need your data to sell you products, deliver them, and handle returns and refunds. Without it we cannot process your order.
- Legal obligation (Art. 6(1)(c)): we must keep invoices and accounting records under Spanish tax and commercial law, and provide customs data for shipments outside the EU.
- Legitimate interests (Art. 6(1)(f)): to prevent fraud, keep our website secure, improve our service and defend legal claims, always balanced against your rights.
- Consent (Art. 6(1)(a)): for newsletters, non-essential cookies and personalised advertising. Under Spanish law (LSSI, art. 21) and UK law (PECR), we only send marketing emails with your consent, or to existing customers about similar products, and you can unsubscribe in every email.

Where we rely on legitimate interests, we have balanced our interests against your rights. You can ask us for details of that assessment.

Automated checks: our e-commerce platform automatically screens orders for fraud risk. If an order is flagged, a member of our team reviews it before any decision is taken.

5. WHO WE SHARE YOUR DATA WITH

We do not sell your personal data, and we never share it for purposes other than those in this notice. We share only the data each provider needs, and only on a valid legal basis: to fulfil your order, because the law requires it, or with your consent. Every provider that processes data for us is bound by a data processing agreement and must keep your data secure and confidential.

- Shopify (Shopify International Limited, Dublin, Ireland): runs our online store, checkout, orders and customer accounts. Processes data on our behalf under Shopify's Data Processing Addendum.
- Shopify Payments and the other payment providers shown at checkout: process your payment securely. Card data is handled by certified payment providers (PCI DSS); we never see or store your full card number.
- Sendcloud (Sendcloud B.V., Eindhoven, Netherlands): creates shipping and return labels and tracking. Processes data on our behalf under a data processing agreement.
- DHL Express (DHL International GmbH, Bonn, Germany, and its group companies): transports your parcel and clears customs for deliveries outside the EU. Uses your name, address, phone, email and parcel contents to deliver and clear customs, under its own privacy notice.
- Customs and tax authorities (for example HM Revenue & Customs in the UK or U.S. Customs and Border Protection): customs clearance of parcels shipped outside the EU. Only the data the law requires, passed on by the carrier.
- Gorgias (customer service chat and help desk): helps us answer your messages and requests. Processes data on our behalf.
- Klaviyo (email marketing), Google (Google Ads) and Meta (Meta Pixel): newsletters, measuring our ads and showing you personalised ads on Google, Facebook and Instagram. Only if you have given your consent.
- Accountants, lawyers, auditors, courts or public authorities: meeting our legal obligations or defending legal claims. Only when required by law.

If all or part of our business is sold or restructured, data may be transferred to the new owner, who must respect this notice.

6. INTERNATIONAL TRANSFERS

We are based in Spain and your data is mainly processed in the European Union. When a provider processes data outside the EU or the UK, the transfer is protected as the law requires:

- Shopify may process data in Canada and other countries. Canada is recognised by the EU and the UK as providing adequate protection; other transfers are covered by Standard Contractual Clauses in Shopify's Data Processing Addendum.
- Sendcloud is based in the Netherlands (EU). Where it uses providers outside the EU, it uses the European Commission's Standard Contractual Clauses and carries out transfer impact assessments.
- DHL Express transfers shipment data to the destination country to deliver your parcel, protected by its Binding Corporate Rules and Standard Contractual Clauses.
- Klaviyo, Google and Meta may process data in the United States. These companies are certified under the EU-US Data Privacy Framework and its UK Extension, which the EU and the UK recognise as providing adequate protection, and they also use Standard Contractual Clauses. We only use them for marketing if you have given your consent.
- Deliveries outside Europe: sending your details to the carrier and customs in the destination country (for example the UK or the USA) is necessary to deliver the order you placed.

Transfers from the UK to us in Spain are permitted because UK law recognises the EU as providing adequate protection.

7. HOW LONG WE KEEP YOUR DATA

We only collect and keep the personal data we need and are legally authorised to keep. We do not keep data for any purpose you have not been told about in this notice.

- Order, invoice and accounting records: 6 years from the end of the financial year (Spanish Commercial Code, art. 30).
- Customer account: until you close it, then up to 2 years for claims and fraud prevention.
- Customer service messages: 2 years after the issue is closed.
- Marketing data: until you unsubscribe or withdraw consent.
- Cookies: as stated in our Cookie Notice (maximum 13 months for consent-based cookies).

After these periods we delete or anonymise your data.

8. COOKIES AND SIMILAR TECHNOLOGIES

We use essential cookies to make our website work (for example your basket and checkout). With your consent, we and our partners also use analytics and advertising cookies and pixels. You can accept, reject or choose your preferences through the cookie banner shown when you visit our website, and you can change your choice at any time. Rejecting non-essential cookies does not affect your ability to shop. Full details are in our Cookie Notice, available at https://cesaregaspari.eu/pages/cookie-policy.

9. CHILDREN

Our website is not intended for anyone under 18, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.

10. YOUR RIGHTS

Under the EU GDPR, the UK GDPR and Spanish data protection law, you have the right to:

- access your personal data and receive a copy;
- correct inaccurate data;
- have your data erased;
- restrict or object to how we use it, including objecting to direct marketing at any time;
- receive your data in a portable format;
- withdraw your consent at any time, without affecting processing already carried out;
- not be subject to a decision based solely on automated processing that significantly affects you.

To exercise your rights, email info@cesaregaspari.eu or use our online data request form at https://app.termly.io/notify/4bfcabff-4707-45dd-885b-e8fc3ab2840d. We will reply within one month. We may ask you to confirm your identity. Exercising your rights is free.

US residents: see section 12 for your rights under US state laws.

11. HOW TO COMPLAIN

Complaints to us. If you are unhappy with how we use your personal data, you have the right to complain to us first. You can do so by email to info@cesaregaspari.eu or through our online data request form (https://app.termly.io/notify/4bfcabff-4707-45dd-885b-e8fc3ab2840d). When you complain, we will:

1. acknowledge your complaint within 30 days of receiving it;
2. investigate it without undue delay, including asking you for any information we need;
3. keep you informed of the progress of your complaint;
4. tell you the outcome without undue delay.

This procedure follows the UK GDPR as amended by the Data (Use and Access) Act 2025 and applies equally to customers in the EU.

Complaints to a supervisory authority. You can also complain to a data protection authority (in the UK, the ICO normally expects you to raise it with us first):

- Spain and the EU: Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, Spain, www.aepd.es, or the data protection authority in the EU country where you live or work.
- United Kingdom: Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, ico.org.uk, telephone 0303 123 1113.
- Switzerland: Federal Data Protection and Information Commissioner (FDPIC), www.edoeb.admin.ch.

You also have the right to go to court if you believe your data protection rights have been infringed.

12. ADDITIONAL INFORMATION FOR US RESIDENTS

This section applies to residents of the United States, including California and other states with consumer privacy laws (such as the California Consumer Privacy Act as amended by the CPRA). It adds to the rest of this notice.

Personal information we collect. In the last 12 months we have collected these categories of personal information, from you directly, from your device, and from our service providers:

- Identifiers: name, email address, postal address, phone number, IP address, online identifiers.
- Customer records: billing and delivery details, limited payment details (we do not store full card numbers).
- Commercial information: products bought, returned or considered, order history.
- Internet or other electronic activity: browsing and interaction with our website, emails and ads.
- Approximate location: country or city derived from your IP address.

We use these categories for the purposes in section 4 and disclose them to the recipients in section 5. We do not collect sensitive personal information as defined by US state laws, and we do not use personal information to make decisions that produce legal or similarly significant effects.

Sale, sharing and targeted advertising. We do not sell your personal information for money. However, if you accept advertising cookies, Google and Meta may collect data through their tags and pixels on our website to show you personalised ads. Under some US state laws this may count as "selling" or "sharing" personal information, or as "targeted advertising". You can opt out at any time by:

- using the "Your Privacy Choices" link in our website footer;
- rejecting advertising cookies in our cookie banner; or
- turning on the Global Privacy Control (GPC) signal in your browser, which we treat as a valid opt-out request.

We do not knowingly sell or share the personal information of anyone under 16.

Your rights. Depending on the state where you live, you have the right to:

- know what personal information we collect, use and disclose, and receive a copy;
- delete your personal information;
- correct inaccurate personal information;
- opt out of the sale or sharing of your personal information and of targeted advertising;
- not be discriminated against for exercising your rights (we will not charge you a different price or give you a different level of service);
- appeal our decision if we refuse your request, by replying to our decision email with the word "Appeal". If your appeal is denied, you can contact your state Attorney General.

How to make a request. Email info@cesaregaspari.eu or use our online data request form at https://app.termly.io/notify/4bfcabff-4707-45dd-885b-e8fc3ab2840d. We will confirm receipt within 10 business days and respond within 45 days (extendable by another 45 days if necessary, with notice to you). We will need to verify your identity, usually by matching the email address and order details we hold. You can use an authorised agent to make a request on your behalf; we may ask for proof of their authorisation.

Marketing emails. Every marketing email includes an unsubscribe link, in line with the US CAN-SPAM Act.

Data transfers. If you shop from the US, your personal information is transferred to and processed in Spain and the EU, where it is protected under the EU GDPR as described in this notice.

13. CHANGES TO THIS NOTICE

We may update this notice. The "Last revised" date at the top shows when it last changed. If we make significant changes, we will tell you on our website or by email.

14. CONTACT US

Anneta Shoes S.L. (Cesare Gaspari)
NIF / VAT: ESB67562801
Antic Camí Ral de València 38, local 15, 08860 Castelldefels, Barcelona, Spain
Email: info@cesaregaspari.eu