Privacy Policy

Last updated: September 15, 2026

This Privacy Policy explains how Biscotto Stone collects, uses, stores and discloses personal information when you visit our website, purchase our products, create an account, contact us or otherwise use our services (the “Services”).

This Privacy Policy is provided in accordance with applicable data protection legislation, including, where applicable, Regulation (EU) 2016/679 (the “GDPR”).

1. Data Controller

The controller responsible for the processing of personal data collected through this website is:

Owner / Legal entity: Francesco Sorbo
Registered business address: Via Ungaretti 14/B, 81040 Curti (CE), Italy
VAT number: IT04915770616
REA / Business registration number: CE-365828
Email: info@biscottostone.com

For any questions concerning this Privacy Policy or the processing of your personal data, you may contact us at info@biscottostone.com.

2. Personal Information We Collect

Depending on how you interact with our Services, we may process the following categories of personal information:

Category	Examples
Identification and contact information	Name, surname, email address, billing address and shipping address
Order and transaction information	Products purchased, order history, returns, refunds, exchanges and cancellations
Payment information	Information necessary to process payments and payment confirmations. Payment card information may be processed directly by Shopify, Shopify Payments or other authorized payment service providers
Account information	Account details, preferences and account settings
Communications	Information you provide when contacting customer service or otherwise communicating with us
Technical information	IP address, browser, device, network information and technical identifiers
Usage information	Information about how you browse and interact with our website, subject to applicable cookie and consent requirements
Marketing preferences	Your choices regarding marketing communications, advertising and cookies

We only process personal information that is reasonably necessary for the purposes described in this Privacy Policy.

3. Sources of Personal Information

We may obtain personal information directly from you when you place an order, create an account, contact us or otherwise provide information to us.

We may also receive information automatically when you use our website, including through cookies and similar technologies where permitted by law.

Personal information may also be received from service providers, Shopify, payment providers, delivery companies, business partners and other third parties involved in providing our Services.

4. Purposes and Legal Bases for Processing

Where the GDPR applies, we process personal data only when we have a valid legal basis.

Purpose	Legal basis
Processing and fulfilling orders	Performance of a contract or steps taken at your request before entering into a contract
Processing payments	Performance of a contract and compliance with legal obligations
Arranging shipping and delivery	Performance of a contract
Processing returns, refunds and exchanges	Performance of a contract and compliance with applicable consumer protection law
Providing customer support	Performance of a contract, pre-contractual measures or our legitimate interest in providing customer service
Maintaining customer accounts	Performance of a contract
Accounting, invoicing and tax obligations	Compliance with legal obligations
Fraud prevention, website security and abuse prevention	Our legitimate interests in protecting our business, customers and Services and, where applicable, compliance with legal obligations
Establishing, exercising or defending legal claims	Our legitimate interests and compliance with applicable legal obligations
Marketing communications	Your consent where required by applicable law, or another lawful basis where expressly permitted by law
Personalized advertising and non-essential tracking	Your consent where required by applicable law
Improving our Services and understanding website use	Our legitimate interests where the processing does not require consent; where cookies or similar technologies require consent, processing will take place only after consent has been obtained

Where processing is based on our legitimate interests, we consider those interests against your rights and freedoms before carrying out the processing.

Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

5. Information Required to Complete a Purchase

Certain personal information, such as your name, delivery address, billing information and contact details, is necessary to enter into and perform a purchase contract with us.

If you do not provide information that is necessary to process and deliver your order, we may be unable to complete the transaction or provide the requested Services.

6. Marketing Communications

Where required by applicable law, we will send promotional emails, SMS messages or other electronic marketing communications only with your consent.

You may withdraw your consent or unsubscribe from marketing communications at any time by using the unsubscribe link contained in our communications or by contacting us at info@biscottostone.com.

Withdrawing from marketing communications will not prevent us from sending service-related communications concerning orders, payments, deliveries, returns or your account.

7. Cookies and Similar Technologies

Our website may use cookies and similar technologies for purposes including website functionality, security, remembering user preferences, analytics and advertising.

Cookies and tracking technologies that are not strictly necessary for the operation of the website will only be used where permitted by applicable law and, where required, after obtaining your consent.

You can manage or withdraw your cookie preferences through the cookie preference tool available on our website.

Additional information about the cookies and tracking technologies used on the website should be provided in our Cookie Policy.

8. Disclosure of Personal Information

We may disclose personal information where necessary to operate our business and provide our Services.

Recipients may include Shopify and its authorized subprocessors, payment service providers, banks and payment networks, hosting and IT service providers, shipping and logistics companies, customer support providers, professional advisers, accountants, tax advisers, legal advisers, fraud prevention providers, analytics providers and marketing providers where permitted by applicable law.

Personal information may also be disclosed where required by law, regulation, court order or a valid request from a competent public authority, or where necessary to establish, exercise or defend legal claims.

We do not disclose personal information to third parties for purposes incompatible with those described in this Privacy Policy.

9. Shopify

Our online store is hosted and powered by Shopify.

For many of the services used to operate our store, we act as the data controller and Shopify processes customer personal information on our behalf as a data processor.

For certain Shopify services and enhanced features, Shopify may process personal information for its own purposes and may act as an independent data controller, as described in Shopify's applicable privacy documentation and Data Processing Addendum.

Information submitted through our store may therefore be transmitted to and processed by Shopify and its authorized service providers.

Further information about Shopify's processing of personal information is available in the Shopify Consumer Privacy Policy and Shopify's privacy documentation.

10. International Transfers

Some of our service providers, including Shopify and its authorized subprocessors, may process personal information outside your country of residence or outside the European Economic Area.

Where personal information protected by the GDPR is transferred to a country outside the European Economic Area that has not been recognized by the European Commission as providing an adequate level of data protection, appropriate safeguards will be used as required by applicable law.

Such safeguards may include the European Commission's Standard Contractual Clauses or other legally recognized transfer mechanisms.

You may contact us at info@biscottostone.com for further information about the safeguards applicable to international transfers of your personal data.

11. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected and in accordance with applicable legal requirements.

Order, invoicing and accounting information may be retained for the period required under applicable Italian accounting and tax legislation.

Information required to comply with accounting obligations may generally need to be retained for up to 10 years, subject to any longer retention period required in connection with tax assessments, litigation or other legal obligations.

Customer account information is generally retained while the account remains active and thereafter only for the period reasonably necessary to comply with legal obligations, resolve disputes or protect our legal rights.

Customer service communications are retained for the time necessary to handle the request and may be retained for a longer period where necessary to establish, exercise or defend legal claims.

Marketing data is retained until you withdraw your consent, object to the processing where applicable, or until it is no longer necessary for the relevant marketing purpose.

Technical, security and fraud prevention information is retained only for the period reasonably necessary for security, fraud prevention and protection of our Services, unless a longer period is required by law or necessary in connection with a dispute.

When personal information is no longer required, it will be deleted, anonymized or otherwise handled in accordance with applicable law.

12. Security

We implement appropriate technical and organizational measures designed to protect personal information against unauthorized access, accidental loss, alteration, disclosure or destruction.

However, no method of electronic transmission or storage can guarantee absolute security.

You are responsible for protecting the confidentiality of your account credentials and should not disclose your password or other access information to third parties.

13. Your Rights

If the GDPR or other applicable data protection legislation applies to you, you may have the right to request access to your personal data, obtain rectification of inaccurate data, request erasure of your personal data, request restriction of processing, object to certain processing and receive personal data in a portable format where the requirements for data portability are met.

Where processing is based on consent, you have the right to withdraw your consent at any time.

Where personal data is processed for direct marketing purposes, you have the right to object to such processing at any time.

To exercise your rights, please contact us at info@biscottostone.com.

We may request information reasonably necessary to verify your identity before responding to your request.

Requests will be handled within the time periods required by applicable law.

14. Right to Lodge a Complaint

If you believe that the processing of your personal data infringes applicable data protection legislation, you have the right to lodge a complaint with the competent supervisory authority.

If you are located in Italy, the competent supervisory authority is:

Garante per la protezione dei dati personali

You may also lodge a complaint with the data protection supervisory authority of the EU or EEA country in which you habitually reside, work or where the alleged infringement occurred.

We encourage you to contact us first at info@biscottostone.com so that we can try to address your concern.

15. Targeted Advertising and Privacy Choices

Depending on your location and applicable law, you may have rights regarding targeted advertising, sharing of personal information or similar processing.

Where required by applicable law, personalized advertising and tracking will be carried out only after obtaining the necessary consent.

Where available, you may manage these choices through the privacy and cookie controls provided on our website.

If applicable to your jurisdiction, you may also use our Data Sharing Opt-Out page.

Where required by applicable law and supported by our systems, recognized privacy preference signals may be processed in accordance with the applicable legal requirements.

16. Third-Party Websites

Our Services may contain links to third-party websites or services.

We are not responsible for the privacy, security or content of websites operated independently by third parties.

We recommend reviewing the privacy policies of any third-party website before providing personal information.

17. Children's Privacy

Our Services are not intended specifically for children, and we do not knowingly collect personal information from children in violation of applicable law.

If you are a parent or legal guardian and believe that a child has provided personal information to us unlawfully, please contact us at info@biscottostone.com so that we can evaluate the request and take appropriate action.

18. Automated Decision-Making

Where we carry out processing involving solely automated decision-making that produces legal effects or similarly significantly affects you, we will provide the information and safeguards required by applicable data protection legislation.

Fraud prevention, payment and security providers may use automated tools as part of their services. Their processing is subject to the applicable privacy information and legal requirements.

19. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our practices, technologies, legal requirements or Services.

When we make changes, we will publish the updated Privacy Policy on this website and update the “Last updated” date.

Where required by law, we will provide additional notice of material changes.

20. Contact Us

For questions concerning this Privacy Policy, the processing of your personal information or the exercise of your data protection rights, please contact:

Francesco Sorbo
Registered business address: Via Ungaretti 14/B, 81040 Curti (CE), Italy
VAT number: IT04915770616
REA / Business registration number: CE-365828
Email: info@biscottostone.com