Privacy notice on the processing of personal data

Who processes your data

Oceanlife S.r.l.
via Albergati 134 M-N — 40059 Medicina (BO)
P.IVA 02750741205 · Reg. Imprese Bologna · REA BO464279 · cap. soc. 10000
shop@oceanlife.it · PEC oceanlife@pec.it

Oceanlife Corals S.r.l.
via Albergati 134 M — 40059 Medicina (BO)
P.IVA 04266791203 · Reg. Imprese Bologna · REA BO580882 · cap. soc. 10000
info@oceanlifecorals.com · PEC communications@pec.oceanlifecorals.com

HOW WE HANDLE YOUR PERSONAL DATA
 
This page explains what data we collect when you use this shop, why we collect
it, who we show it to and how long we keep it. It is written to be read: if
something is not clear, write to us and we will explain it.
 
The details of those responsible for this processing - company name,
registered office, VAT number and contact details - are given at the top of
this page.
 
 
1. WHO DECIDES WHAT IS DONE WITH YOUR DATA
 
This shop sells on behalf of TWO companies: Oceanlife S.r.l. and Oceanlife
Corals S.r.l. This is not an organisational detail, because it changes who is
responsible for what.
 
 - You have just ONE ACCOUNT, and it is valid for both: email address,
   password, name, contact details, your preferences and your consent to the
   newsletter. The two companies decide on this data TOGETHER, and are
   therefore JOINT CONTROLLERS under Article 26 of Regulation (EU) 2016/679
   (GDPR).
 - Your ORDER, on the other hand, belongs to ONE company only - the one that
   sells the items you bought - and it is that company that issues the
   invoice, ships the goods and keeps the documents. For that data it is an
   INDEPENDENT CONTROLLER.
   If a single purchase includes items from both, the shop generates two
   separate orders, and tells you so while you are placing it.
 
The two companies also share the CUSTOMER RECORDS ARCHIVE described in point
2.g: when you open an account, to recognise you we look for your VAT number,
your tax code or your email among the customer records of BOTH companies, not
only of the one you are buying from. This is so that we do not create a second
customer file for you, and we mention it because it is sharing between two
different companies, not a technical detail.
 
What this means for you, in practice: you can contact EITHER of the two
companies to exercise your rights, even if they concern the other one. We will
pass the request on between ourselves. You do not have to guess whom to write
to.
 
The servers this shop runs on, together with the database and the email, are
located at the premises of Oceanlife S.r.l.
 
 
2. WHAT DATA, AND WHY
 
a) TO OPEN YOUR ACCOUNT AND KEEP IT OPEN
   Email address, password (which we store encrypted and which none of us can
   read), first name, surname, telephone number. If you buy as a company or as
   the holder of a VAT number: also company name, VAT number, tax code (codice
   fiscale), recipient code (codice destinatario) or PEC (Italian certified
   email) address for electronic invoicing.
   Why we may do this: because without this data we cannot give you an account
   or conclude a sales contract with you (Art. 6.1.b GDPR); the tax data is
   required of us by law (Art. 6.1.c).
 
b) TO GET WHAT YOU BOUGHT TO YOU
   The delivery address, the telephone number - which is for the courier, not
   for marketing - and any notes you write yourself.
   When you place the order, this data is FROZEN on the order itself: if you
   later change the address in your account, the old order still shows where
   it was actually shipped. It is a safeguard for both of us.
   Why we may do this: contract (Art. 6.1.b).
 
c) TO INVOICE AND KEEP THE ACCOUNTS
   The order details, the amounts, the payment method, the tax documents.
   Why we may do this: it is a legal obligation (Art. 6.1.c).
 
d) FOR THE NEWSLETTER, ONLY IF YOU ASK FOR IT
   Your email address.
   Why we may do this: because you told us you wanted it (Art. 6.1.a). It is
   optional, it changes nothing about what you can buy, and you can
   unsubscribe with one click at the bottom of every message.
 
e) TO BE ABLE TO PROVE WHAT YOU CONSENTED TO
   Every time you tick a box we record: the sentence you had in front of you,
   in which language, the version number of this privacy policy, the date and
   time, and the IP address the tick came from. The same applies to the
   statement of withdrawal from a purchase, to the confirmation of your email
   address and to requests to reset your password.
   Why we may do this: because the law requires us to be able to DEMONSTRATE
   consent (Art. 7.1 GDPR), and because we have a legitimate interest in
   defending ourselves if someone raises a dispute (Art. 6.1.f).
   ⚠️ This is also why withdrawing a consent does not delete the earlier line:
   that line proves that, yesterday, that communication was lawful.
 
f) TO KEEP THE SHOP RUNNING AND SECURE
   The contents of your basket; the logins to your account; if you use
   two-step verification, your access keys (passkeys) and recovery codes; and
   the technical logs of the operations carried out by our staff.
   Why we may do this: legitimate interest in the security of the service (Art.
   6.1.f).
 
g) THE COPY OF THE CUSTOMER RECORDS FROM OUR MANAGEMENT SYSTEM
   This is the least obvious part, and we set it out in full.
   We issue our invoices with a management system, and that is where our
   customers' records live. The shop keeps a COPY of them - company name or
   name, VAT number, tax code, email, address - including records of people
   and companies that have never opened an account on the shop.
   It serves two purposes only: to issue the invoice with the right details,
   and to avoid creating in the management system a second customer identical
   to the first every time something is written slightly differently.
   ⚠️ If you have already bought something from us outside this website - by
   phone, by email, in person - your data is probably in that copy.
   Why we may do this: the obligation to issue correct tax documents (Art.
   6.1.c) and a legitimate interest in keeping customer records free of
   duplicates (Art. 6.1.f).
   If you open an account with the same email or the same VAT number, your
   data in the shop is ALIGNED with the data in the management system and we
   tell you so by email: it is not a change made behind your back.
 
h) IF YOU WERE ALREADY A CUSTOMER OF OUR PREVIOUS SHOP
   When we replaced the old shop with this one, we moved over here the
   accounts of those who had already bought from us, with their data and their
   encrypted password, so that you would not have to start again from scratch.
   Why we may do this: continuity of the existing relationship and a legitimate
   interest in not interrupting a service you were using (Art. 6.1.b and f).
 
 
3. WHO WE SHOW YOUR DATA TO
 
We do not sell your data to anyone and we do not pass it on for advertising
purposes. It is seen only by:
 
 - our MANAGEMENT SYSTEM, where the invoices are created. It runs on our own
   machines, at the premises of Oceanlife S.r.l., and the company that
   supplies it has no remote access to it: it is therefore not a recipient of
   your data;
 - those who DELIVER the parcel. Couriers vary according to the goods: for
   live animals we use specialist carriers, for everything else ordinary
   express couriers. We give all of them the name, address and telephone
   number needed for delivery, and nothing else;
 - those who collect the PAYMENT. If you pay with PayPal, you enter your
   details on the PayPal website yourself: your payment details do not pass
   through us and we do not keep them. PayPal is an independent controller for
   what it does;
 - the ACCOUNTING FIRM that keeps our books, for the accounting records and
   tax returns. It processes your data on our behalf and on our instructions;
 - the Italian Revenue Agency (Agenzia delle Entrate), through the Exchange
   System (Sistema di Interscambio), for electronic invoices - because the law
   requires us to.
 
If you want to know the NAMES and not just the categories, ask us: you have
the right to know them (Article 15 of the GDPR) and we will tell you.
 
We do not use any hosting provider: the shop, the database and the email run
on our own machines, at the premises of Oceanlife S.r.l.
 
Your data leaves the European Union in one case only: PayPal belongs to a
group with companies in the United States, and transfers take place under the
safeguards provided for in Chapter V of the GDPR. If you do not use PayPal,
this does not concern you.
 
 
4. HOW LONG WE KEEP IT
 
 - Invoices and tax documents: TEN YEARS, because Article 2220 of the Italian
   Civil Code (Codice Civile) requires it. We cannot shorten this period, even
   if you ask us to.
 - Your account: for as long as you keep it open. We do not close it for
   inactivity and it has no expiry date: it stays there for as long as you want
   it. You can ask us to close it at any time by writing to one of the
   addresses at the top of this page.
   When we close it, the email address, password, name, contact details, VAT
   number, your delivery addresses, the basket and the passkeys are deleted:
   from that moment you can no longer log in, and to buy again you need to
   register from scratch.
   ⚠️ What remains, however, are your ORDERS, with the details that were on
   them on the day you placed them - name, address, email and telephone
   number. This is not our choice: invoices are kept for ten years (Article
   2220 of the Italian Civil Code), and Article 17(3)(b) of the GDPR states
   that the right to erasure does not cover what one is obliged to keep.
   ⚠️ And if you have an order still in progress - not yet shipped, or with a
   payment not yet received, or with a withdrawal from the purchase that we
   still have to assess - we close the account afterwards, not before: we tell
   you so and wait for it to be completed.
 - Proof of your consents: kept even after withdrawal, because its very
   purpose is to show what happened before. The IP address and the date
   recorded alongside a consent are part of that proof and stay with it.
 - Baskets left half-finished: 90 DAYS from the last time you touched them,
   whether or not you have an account. If you come back sooner, you will find
   your shopping where you left it; if you do not, the basket disappears on
   its own.
 - IP addresses recorded for security reasons - password reset requests,
   email address confirmations: 12 months.
 - The log of operations carried out by our staff in the admin panel:
   24 months.
 - The copy of the customer records from the management system: for as long as
   those records exist in the management system. It is updated at every
   synchronisation.
 
5. COOKIES
 
This shop uses ONLY ONE cookie: the one that keeps your session open, that is,
the one that keeps you logged in and stops you losing your basket while you
move from page to page. It disappears when you close your browser.
 
We do not use profiling cookies, we have no third-party analytics, and we do
not load fonts, maps or videos from other sites. That is why you do not see a
banner asking you to accept cookies: with technical cookies only, the law does
not require one.
 
If one day we add third-party tools, this page will change FIRST, and a banner
will appear that keeps them switched off until you decide.
 
 
6. WHAT YOU CAN ASK US
 
At any time, you can ask us:
 
 - to let you see what data we hold about you, and to give you a copy of it;
 - to rectify it, if it is wrong or incomplete;
 - to erase it, when we are not obliged to keep it;
 - to restrict its use, or to object to processing that we carry out on the
   basis of legitimate interest;
 - to give you, in a file, the data you provided to us, so that you can take it
   elsewhere;
 - to stop relying on a consent you had given us - the newsletter, for
   example - because you withdraw it, without this making unlawful what we did
   before.
 
The consents you have given and their history can always be found in your
account area, on the "Your consents" page.
 
To exercise these rights, write to either of the two companies, at the
addresses at the top of this page: you do not have to guess which one. We
normally reply within a few working days, and in any case within one month,
as required by Article 12 of the GDPR.
 
We have not appointed a data protection officer (DPO): we do not fall under
any of the cases in which Article 37 of the GDPR makes this mandatory. For any
question about your data, write to the addresses above: the people who process
the data will answer you directly.
 
If you think something is wrong, you can contact the Italian Data
Protection Authority (Garante per la protezione dei dati personali) - Piazza
Venezia 11, 00187 Roma - www.garanteprivacy.it. You can do so even
without having written to us first, but if you do write to us, we will try to
sort it out.