Privacy Policy

Privacy Policy

Alessandra Borriello S.r.l.

Last updated: 10 September 2026

Alessandra Borriello S.r.l. (trading as Alexandra Cameos) collects, uses, discloses and protects your personal data when you visit www.alexandracameos.com (the “Website”) or purchase our Products. Please read this policy carefully before using the Website or providing us with any personal information.

We are committed to protecting your privacy and processing personal data in accordance with Regulation (EU) 2016/679 (“GDPR”), the Italian Personal Data Protection Code (Legislative Decree No. 196/2003, as amended by Legislative Decree No. 101/2018) and any other applicable data protection laws, including, where relevant, the UK GDPR and the California CCPA/CPRA.

1. Data Controller

The Data Controller is:
Alessandra Borriello S.r.l.
Registered office: Viale della Gioventù 10/B, 80059 Torre del Greco (NA), Italy
VAT no. 06964761214

For any questions about your personal data, you may use the details above or write to: info@alexandracameos.com

2. Personal data we collect

2.1 Data you provide directly

  • Identity data: first name, last name
  • Contact data: email address, telephone number, postal address
  • Account data: username, password (stored in encrypted form), purchase history
  • Payment data: billing address, payment method details (processed by our payment providers; we do not store full card numbers)
  • Order data: items purchased, delivery address, order notes
  • Communications data: messages, enquiries or feedback
  • Marketing preferences: whether you opt in or out of marketing communications

2.2 Data we collect automatically

When you visit the Website we collect certain technical data through cookies and similar technologies, including:

  • IP address and approximate geolocation
  • Browser type and version, operating system, device type
  • Pages visited, time spent on pages, referring URLs
  • Clickstream data and interaction with Website features

For details, please see our Cookie Policy.

2.3 Data from third parties

We may receive personal data from payment providers, shipping carriers, platforms (e.g. Shopify) or analytics and marketing providers, solely for the purposes described in this Policy and, for non-essential cookies, only after consent.

3. Purposes and legal bases

Contract performance and order management — Article 6(1)(b) GDPR
We process identity, contact, order and payment data to receive and fulfil your order and to handle shipping, returns and after-sales support.

Legal obligations — Article 6(1)(c) GDPR
We process certain data to comply with Italian and EU tax, accounting and consumer-protection obligations.

Customer account management — Article 6(1)(b) GDPR
If you create an account, we process your data to manage your profile, order history and preferences.

Marketing communications — Article 6(1)(a) GDPR
Only with your explicit consent may we use your email address (and, if collected, your phone number) for newsletters, offers and new collection launches. You may withdraw consent at any time.
For existing customers, communications about similar products may, where the legal conditions are met, rely on Article 130(4) of the Italian Privacy Code (soft opt-in), with an opt-out in every message.

Improvement of the Website and services — Article 6(1)(f) GDPR and, for non-essential cookies, Article 6(1)(a) GDPR
Non-essential analytics (including Google Analytics 4) and third-party measurement tools run only after consent, as described in the Cookie Policy and, where enabled, through Google Consent Mode v2.

Fraud prevention and security — Article 6(1)(f) GDPR
We may process certain data to detect and prevent fraudulent transactions and to protect the Website.

Personalised advertising and remarketing — Article 6(1)(a) GDPR
Pixels and tags from Meta, Google, TikTok, Pinterest and similar platforms are activated only with consent. With some providers a joint-controllership relationship may exist for measurement and advertising.

Balancing test for legitimate interests: you have the right to object under Article 21 GDPR.

4. Data sharing and disclosure

We do not sell your personal data. We may share it, only as needed for the purposes above, with:

  • payment processors (e.g. Shopify Payments, PayPal, Stripe)
  • shipping and logistics providers
  • IT and platform providers (e.g. Shopify)
  • marketing and analytics providers (e.g. Google, Meta, TikTok, Pinterest, Klaviyo), only on the applicable legal basis
  • legal, accounting and compliance advisers
  • public authorities, where required by law

Recipients act as processors under an Article 28 GDPR contract or, in some cases, as independent controllers or joint controllers.

5. International transfers

Some providers are established outside the EEA, in particular in the United States. Transfers are carried out on the basis of:

  • adequacy decisions (including, where applicable, the EU-US Data Privacy Framework);
  • Standard Contractual Clauses approved by the European Commission;
  • additional security measures.

For details: info@alexandracameos.com

6. Data retention

We keep personal data only for as long as needed for the purposes of collection and for legal obligations.

  • Order, invoicing and accounting records: as a rule 10 years, under Italian tax law.
  • Account data: for the life of the account and for a limited period thereafter for disputes or legal duties.
  • Marketing data: until you withdraw consent or opt out.
  • Cookie consent logs: generally no longer than 24 months, or until you make a new choice.
  • Security and fraud-prevention data: for the time strictly necessary.

7. Your rights

Under Articles 15–22 GDPR you have the right to:

  • access (Art. 15)
  • rectification (Art. 16)
  • erasure (Art. 17)
  • restriction of processing (Art. 18)
  • data portability (Art. 20)
  • object (Art. 21), including to direct marketing
  • withdraw consent (Art. 7(3)), without affecting prior processing

Write to info@alexandracameos.com. We will respond as a rule within 30 days, extendable in the cases provided for by the GDPR.
Complaint: Garante per la protezione dei dati personali, www.garanteprivacy.it.
UK users: Information Commissioner’s Office.
California consumers: rights of access, deletion, correction and opt-out of sale/sharing (“Do Not Sell or Share My Personal Information”), including honouring a Global Privacy Control (GPC) signal where received.

8. Children’s privacy

The Website and Products are not intended for children under 18. We do not knowingly collect personal data from children under 18. If you believe such data has been collected, write to info@alexandracameos.com and we will delete it.

9. Data security

We implement appropriate technical and organisational measures against unauthorised access, loss, destruction or alteration, including TLS/SSL encryption and access controls. If a personal data breach is likely to result in a high risk to your rights, we will notify you in accordance with Article 34 GDPR.

10. Cookies and tracking technologies

The Website uses cookies and similar technologies. Details, categories, durations and consent mechanics are set out in the Cookie Policy. Non-essential cookies are not set before consent.

11. Third-party links

The Website may contain links to third-party sites. This Privacy Policy applies only to our Website. We are not responsible for the privacy practices of third parties.

12. International markets

  • United Kingdom: UK GDPR and PECR.
  • California: CCPA/CPRA (opt-out of sale/sharing; not the European opt-in model).
  • Canada: PIPEDA.
  • Australia: Privacy Act 1988.

13. Changes

We may update this Privacy Policy. The updated version will be posted on the Website with a revised date. For material changes we will notify you by email or by a prominent notice on the Website.

14. Contact

Alessandra Borriello S.r.l.
Registered office: Viale della Gioventù 10/B, 80059 Torre del Greco (NA), Italy
info@alexandracameos.com