Notice

Privacy Policy

Last update: January 2026

United Arab Emirates (UAE) Addendum

The company operates in a UAE free zone. For users resident in the UAE, in addition to the GDPR, the provisions of Federal Decree-Law No. 45 of 2021 on the protection of personal data (UAE PDPL) and the implementing regulations of the UAE Data Office apply, together with the data-protection regulations of the DSO/DIC free zone where applicable.

Legal bases: contract performance, legal obligations, legitimate interest and consent (arts. 4-5 UAE PDPL).
Data subject rights: access, rectification, erasure, restriction, portability, objection to automated processing and withdrawal of consent (arts. 13-19 UAE PDPL).
Cross-border transfers: only to countries with an adequate level or under equivalent contractual safeguards (arts. 22-23 UAE PDPL).
Data breach: notified to the UAE Data Office and to the data subject without undue delay (art. 9 UAE PDPL).
Complaints: may be lodged with the UAE Data Office. Local contact: info@past-drip.com.
Electronic marketing: in compliance with the TDRA and UAE anti-spam rules, promotional communications require explicit opt-in and a permanent opt-out option.

1. General information

This notice is provided pursuant to art. 13 of Regulation (EU) 2016/679 ("GDPR") to users who interact with the website past-drip.com ("Site"). It refers solely to this Site and not to other websites reachable via links.

If the user is under 14, pursuant to art. 8(1) GDPR and art. 2-quinquies of Legislative Decree 196/2003, consent of the holder of parental responsibility is required.

2. Data controller

The data controller is Pastdrip. For any request relating to data processing and to exercise the rights below, write to info@past-drip.com.

3. Types of data processed

Navigation data: IP address, browser type, operating system, pages visited, referrer, date and time of visit. Collected in aggregate form for security and Site operation.
Data provided by the user: name, surname, email, phone, delivery and billing address, given at order or registration.
Order data: products purchased, amounts, payment method (card data are not stored — they are handled directly by the payment provider).
Cookies: see the Cookie Policy.

4. Purposes and legal basis

Performance of the sales contract and order management (art. 6(1)(b) GDPR).
Compliance with tax and accounting obligations (art. 6(1)(c) GDPR).
Customer service, requests, returns and complaints (art. 6(1)(b) GDPR).
Sending commercial communications and newsletters, with explicit consent that can be withdrawn at any time (art. 6(1)(a) GDPR).
Site security and fraud prevention based on the controller's legitimate interest (art. 6(1)(f) GDPR).

5. Processing methods and retention

Data are processed with IT and electronic tools, adopting security measures to prevent unauthorised access, disclosure, alteration or destruction. Order data are retained for the time necessary to perform the contract and in any case for the term required by tax law (10 years). Marketing data are kept until consent is withdrawn.

6. Data recipients

Data may be shared, strictly as needed, with: couriers and logistics operators for delivery, payment providers for collection, IT service providers (hosting, email, CRM), accounting and legal consultants. Such parties act as data processors under art. 28 GDPR.

7. Transfer outside the EU

Some providers may process data outside the European Union. In that case the transfer takes place only towards countries with an adequacy decision by the European Commission or based on standard contractual clauses under art. 46 GDPR.

8. User rights

Pursuant to arts. 15–22 GDPR the user has the right to request access, rectification, erasure, restriction of processing, to object to processing and to request data portability. The user may also withdraw consent at any time and lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it).

Requests can be sent to info@past-drip.com.

9. Changes

This notice may be updated. Please check this page periodically.