Privacy policy

 

Last updated: September 3, 2026

Data Controller
The Data Controller for personal data collected through lapepia.it is LAPEPIA di Lucia Trapassi, Via Antonio Oroboni 76/H, 62012 Civitanova Marche (MC), Italy, VAT no. IT02131420438. For any request regarding the processing of personal data, please write to info@lapepia.it.

This policy is drafted in accordance with EU Regulation 2016/679 (GDPR) and the Italian Data Protection Code (Legislative Decree 196/2003, as amended by Legislative Decree 101/2018), and describes what personal data is collected on lapepia.it, for what purposes, on what legal basis, and for how long.

What data is collected

Data provided directly: contact details (name, address, phone, email), order information (billing and shipping address, payment confirmation), account information (username, password), information provided in communications with customer care.

Data collected for product personalization: some LAPEPIA products include name embroidery, provided voluntarily by the parent or purchaser at the time of order. This data is used exclusively for the production of the personalized item and kept for the time necessary to complete the order and manage any returns or disputes, according to the terms set out later in this policy.

Data collected automatically: device, browser and network connection information, IP address and browsing data, collected through cookies and similar technologies (see dedicated section).

Data obtained from third parties: suppliers that support the operation of the Site (e.g. Shopify), payment processors (for transaction processing) and, where consent is active, the advertising and analytics partners listed in the Cookies section.

Some data is necessary for the performance of the contract (for example, the shipping address): without it, the order cannot be fulfilled.

 

Why this data is processed

Purpose	Legal basis
Fulfilling orders, managing payments, shipping, returns and customer care	Performance of a contract (Art. 6.1.b GDPR)
Tax and accounting obligations	Legal obligation (Art. 6.1.c GDPR)
Site security and fraud prevention	Legitimate interest (Art. 6.1.f GDPR)
Marketing communications, personalized advertising, non-essential cookies	Consent (Art. 6.1.a GDPR), collected through the Site's cookie banner

Consent given for marketing purposes may be withdrawn at any time through the cookie banner settings or by writing to info@lapepia.it, without affecting the lawfulness of processing already carried out.

The Site uses a cookie banner that allows separate choices across the categories Necessary, Personalization, Marketing and Analytics. Necessary cookies are always active; the other categories are activated only after explicit consent and can be changed at any time from the banner settings.

Service	Category	Purpose
Meta Pixel (Facebook and Instagram)	Marketing	Advertising campaign measurement and ad personalization
Pinterest Tag	Marketing	Measurement of traffic from Pinterest and any advertising campaigns
Google Analytics	Analytics	Aggregate visit statistics and browsing behaviour
Microsoft Clarity	Analytics	Heatmaps and anonymized session recording to understand Site usage. The service partly relies on the broader Microsoft advertising infrastructure, which may set additional cookies linked to the same category
Judge.me	Analytics	Collection and management of product reviews

The Personalization category covers optional store features (for example, product suggestions based on browsing), managed directly by Shopify without involving external providers.

The Site also embeds Instagram content (Instafeed): displaying this content involves a direct request to Meta's servers, which may record the IP address of the person viewing the page, in accordance with Meta's privacy policy.

Marketing and analytics cookies vary in duration depending on the service, generally ranging between 90 days and 24 months.

Remarketing through Shop
The Site uses Shopify's native remarketing features, which can send automatic reminders (for example, in the case of an abandoned cart, availability of a previously viewed item, or a price change on a previously viewed product) to people using the Shop app or who provided their email address while browsing. This feature is managed directly by Shopify in accordance with its own privacy policy.

Personal data may be shared with: suppliers that support the business (Shopify platform, payment processors, couriers for shipping, customer care chat service); advertising and analytics partners listed in the Cookies section, only with active consent; competent authorities, where required by law.

The Site also uses Shopify Network Intelligence, a feature that shares certain data in aggregate form with the broader Shopify infrastructure, shared across all stores using it, for fraud prevention, product improvement and personalization purposes. No other store can view LAPEPIA's specific data. In the event of a data deletion request, removal is automatically extended to this feature as well.

Data collected through the Site is hosted on servers located in the European Union.

Some of these providers (Meta, Google, Pinterest, Microsoft) are based in the United States. Transfer of data to non-EU countries is carried out on the basis of the European Commission's Standard Contractual Clauses or equivalent recognized mechanisms.

The Site allows product reviews through Judge.me. Published reviews, including any name or initials associated with them, are publicly visible to anyone visiting the Site. LAPEPIA is not responsible for any use third parties may make of information voluntarily made public in a review.

The Site may contain links to external sites: please refer to their respective privacy policies, as LAPEPIA is not responsible for data processing carried out by sites it does not directly operate.

The Site is intended for purchases made by adults; account, payment and browsing data always relate to the person making the purchase, not the child. The only exception is the child's name provided for embroidered personalizations, processed solely for the purpose described above and provided voluntarily by whoever holds parental responsibility.

Order-related data is kept for the period required by tax and accounting obligations under Italian law (10 years). Data collected through marketing and analytics cookies is kept according to the duration set by each service, generally ranging between 90 days and 24 months.

Under Articles 15-22 GDPR, it is possible at any time to request: access to personal data processed, rectification of inaccurate data, erasure, restriction of processing, data portability, objection to processing, and withdrawal of consent. Requests can be sent to info@lapepia.it.

Requests are handled within one month of receipt; this period may be extended by two months for complex requests, with notice of the reasons for the extension. To ensure that information is provided to the correct person, identity verification may be required beforehand.

In the event of a complaint, it is possible to contact LAPEPIA directly at the contact details provided, or to contact the Italian Data Protection Authority (garanteprivacy.it), competent as the authority of the country where LAPEPIA is established, or the data protection authority of one's own country of residence.

LAPEPIA does not carry out automated decision-making, including profiling, that produces legal effects on the data subject.

LAPEPIA adopts appropriate technical and organizational measures to protect personal data from unauthorized access, loss or disclosure. However, no data transmission system is completely secure: it is recommended not to share sensitive information through unprotected channels.

This policy may be updated periodically to reflect regulatory or operational changes. The date of the last update is shown at the top of the page.