Privacy Notice

YA LI BIGIOTTERIA DI DU XIAOHONG, trading name Yali Bijoux — Corso Stati Uniti 1/7 Box 4, 35127 Padua (PD), Italy — VAT 02245620972 — REA PD-417202.

Email: info@yalibijoux.it — PEC: duxiaohong@studiounico.net — phone/WhatsApp: +39 327 035 8971. No Data Protection Officer has been appointed because the current legal conditions for mandatory appointment do not apply.

We process identification and contact data, business and tax data (including company name, VAT number, country, address, SDI or PEC), credentials and authentication data, support requests, language preference, cart content, and information relating to orders, shipping, payments, and refunds.

Stripe processes payment data and may provide us with technical identifiers, status, and transaction amount; Yali Bijoux does not receive or store the full card number. Technical systems may also record IP address, date and time, device data, security events, and logs required for operation and abuse prevention.

We use data to review B2B access applications, create and secure accounts, answer pre-contract requests, and manage carts, orders, payments, shipping, returns, and support. The legal basis is taking steps before entering into a contract or performing the contract (Article 6(1)(b) GDPR).

For invoicing, accounting, tax compliance, and responses to competent authorities, the basis is compliance with legal obligations (Article 6(1)(c)). For security, fraud prevention, protection of legal rights, service continuity, and technical management, the basis is the Controller’s legitimate interest (Article 6(1)(f)), balanced against data-subject rights.

Registration does not subscribe users to newsletters or promotional communications. If optional marketing is introduced, it will require separate consent that can be withdrawn at any time.

Fields marked as required are necessary to verify the business, create the account, and manage an order. Without them, registration or purchasing cannot be completed. Optional fields may be omitted without losing unrelated functions.

VAT-number validity may be checked through official systems such as VIES. Commercial account approval includes human review; we do not make solely automated decisions producing legal effects within the meaning of Article 22 GDPR.

Authorized personnel may access data, and data may be disclosed as necessary to providers acting as processors or independent controllers for their service: Supabase (authentication, database, and storage), Netlify (application hosting and delivery), Stripe (payments and fraud prevention), Resend (transactional email), carriers and logistics platforms, tax or legal advisers, and authorities where required by law.

An updated list of processors and information about applicable safeguards is available on request. We do not sell personal data.

Some providers may process data outside the European Economic Area. Where this occurs, transfers rely on a European Commission adequacy decision or appropriate safeguards under Chapter V GDPR, including Standard Contractual Clauses and supplementary measures where applicable. You may request information or a copy of the safeguards from the Controller.

Account and commercial-relationship data is kept for the relationship and afterwards for the period required to manage claims and legal obligations. Accounting and tax documents and data are retained for 10 years unless litigation or an authority requires longer retention.

Rejected or incomplete registration applications are reviewed and deleted or anonymized, unless needed for security or legal claims, within 24 months. Technical and security logs are retained for a period proportionate to their purpose and provider settings. Cart data stored in the browser remains until the user or the application removes it.

The website uses technical cookies required for authentication, security, and sessions, and localStorage or sessionStorage for the cart, checkout attempt, and user-requested functions. These tools are not used for advertising profiling and do not require consent, while still being described in this notice.

We currently do not install profiling cookies or third-party advertising or analytics trackers. If these are introduced, they will be blocked until the user makes a choice and this notice will be updated.

Where provided by the GDPR, you may request access, rectification, erasure, restriction, and portability, and object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it without affecting earlier lawful processing.

You may lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or the supervisory authority of the EU country where you live or work, without prejudice to judicial remedies.

We use technical and organizational measures proportionate to risk, including access controls, role separation, encrypted connections, and logging of critical events. No system is risk-free; if a personal-data breach occurs, we will apply the GDPR assessment, notification, and communication requirements.

This notice may be updated when processing, providers, or laws change. The version and date appear above; registered users may receive a dedicated notice for material changes.