Privacy policy
Last updated: 6 August 2026
1. Data controller
The controller of personal data is Aurea Luxury Lab S.r.l., a single-member company, with registered office at Via Armando Pica 170/E, 41121 Modena (MO), Italy. C.F. and P.IVA 04262050364, REA MO-456214. PEC aurealuxurylab@postecertifica.it — E-mail info@aurealuxurylab.com.
Aurea Luxury Lab S.r.l. operates this store and website, including the information, content, features, tools, products and services offered (the "Services"). This Policy describes how we collect, use and disclose your personal data when you visit the site, make a purchase, submit an item or communicate with us. In the event of any conflict between the Terms of Service and this Policy, this Policy prevails with regard to the processing of personal data.
2. Personal data we collect
Contact details: first name, last name, residential address, billing address, shipping address, telephone number, e-mail address.
Payment data: card details, account details, transaction details and confirmations, form of payment. Full payment instrument data is processed directly by payment service providers and is not stored on our systems.
Account data: username, login credentials, preferences and settings.
Transaction data: items viewed, added to the cart or wish list, purchased, returned or exchanged, and order history.
Communications: content of support requests, complaints and disputes, including images and videos sent in support of a return request or a report of transport damage.
Data relating to the submission of items: for users of the Aurea ReBag service, identification data, details of a valid identity document, bank details for payment, description and photographs of the item submitted.
Device data: device, browser, network connection, IP address and other unique identifiers.
Usage data: how and when you interact with the Services.
3. Sources of data
We collect data directly from you, automatically through the Services and cookies, from our service providers when we engage them to carry out activities on our behalf, and from our business partners.
4. Purposes of processing and legal bases
Performance of the contract and pre-contractual measures — management of orders, payments, shipping, returns and refunds, account management, assessment and purchase of items submitted through Aurea ReBag, customer service. Legal basis: performance of a contract to which you are a party.
Legal obligations — accounting and tax obligations, issuing and retaining sales and purchase documents, keeping the registers required by the legislation on trade in antique or used goods, including records of the identity of the persons from whom we purchase pre-owned (used) goods, management of the legal guarantee of conformity. Legal basis: compliance with legal obligations.
Security and fraud prevention — account authentication, transaction verification, prevention and detection of fraudulent, unlawful or harmful activities, verification of the authenticity and correspondence of returned items. Legal basis: legitimate interest in protecting our Services, our customers and our assets.
Direct marketing — sending promotional communications by e-mail and SMS relating to products and services similar to those purchased. Legal basis: consent, or legitimate interest within the limits set by applicable law for existing customers. You may object at any time without any formality.
Personalised advertising and analytics — measuring site performance and interest-based advertising on third-party platforms. Legal basis: consent given through the cookie banner.
Establishment and exercise of rights — management of disputes, litigation and debt collection. Legal basis: legitimate interest and the establishment, exercise or defence of legal claims.
5. Marketing communications by e-mail and SMS
We use the e-mail address and telephone number you provide to send you promotional communications, offers, updates and reminders. Telephone numbers are collected with prior express consent and are not disclosed to unaffiliated third parties for promotional purposes.
You may withdraw your consent at any time via the unsubscribe link included in every communication or by writing to info@aurealuxurylab.com. Even after withdrawal, we will continue to send you service communications relating to orders and your account.
6. Aurea ReBag service and trade in used goods
Anyone who submits an item through the Aurea ReBag service provides us with identification data, details of an identity document and the bank details required for payment.
The collection and retention of such data, including the recording in the registers required by current legislation on trade in antique or used goods, constitute compliance with a legal obligation and are necessary to conclude the relationship. Failure to provide such data makes it impossible to proceed with the purchase.
The data is retained for the period required by applicable law and is made available to the competent authorities upon request in the cases provided for by law.
7. Recipients of data
We disclose your personal data, to the extent necessary, to the following parties:
service providers acting on our behalf as data processors, including the e-commerce platform, e-mail and marketing service providers, shipping and returns management systems, IT and storage service providers; payment service providers and financial institutions; carriers and couriers responsible for delivery; product authentication and certification service providers; accounting, tax and legal advisers; competent authorities in the cases provided for by law; parties involved in extraordinary transactions concerning the Company.
We do not sell your personal data.
8. Relationship with Shopify
The Services are powered by Shopify, which collects and processes personal data relating to access to and use of the Services in order to provide and improve them. The data you submit to the Services may be transmitted to and shared with Shopify and with third parties that may be located in countries other than your own.
For certain advanced features, Shopify may use personal data collected from your interactions with our store, with other merchants and with Shopify itself. In such circumstances, Shopify is responsible for the related processing, including responding to requests to exercise rights. Further information is available in Shopify's Consumer Privacy Policy and on its privacy portal at https://privacy.shopify.com/en
9. Retention periods
We retain personal data for as long as necessary for the purposes for which it was collected and, in any case, according to the following criteria:
data relating to orders and to accounting and tax documents: 10 years from recording, in compliance with legal obligations; data relating to the legal guarantee of conformity: for the duration of the guarantee and for the limitation period of the related rights; data of persons submitting items and records in the registers of trade in used goods: for the period required by applicable law; account data: until the data subject requests deletion; data for marketing purposes: until consent is withdrawn or an objection is made and, failing that, no longer than 24 months from the last interaction; photographic and video documentation sent in support of complaints and returns: until the case is closed and for the subsequent period useful for the defence of a right; browsing data and cookies: according to the terms set out in the cookie policy.
Once these periods have elapsed, the data is deleted or anonymised, unless retention is necessary for the establishment, exercise or defence of a right.
10. International transfers
Your personal data may be transferred, stored and processed outside the country in which you reside.
Where data is transferred outside the European Economic Area, the transfer takes place on the basis of an adequacy decision of the European Commission or of appropriate safeguards, such as the standard contractual clauses adopted by the European Commission, together with any supplementary measures that may be necessary.
11. Data security
We adopt appropriate technical and organisational measures to protect personal data. However, no security measure can guarantee absolute protection. We ask you not to send us confidential information through unsecured channels and to keep the login credentials for your account safe.
12. Third-party websites and links
The Services may contain links to sites or platforms operated by third parties, to which their respective policies apply. We are not responsible for the privacy, security or content of such sites. Information you share in public contexts or on third-party social media platforms may be visible to other users.
13. Children's data
The Services are not intended for minors and we do not knowingly collect personal data from persons who have not reached the age of majority. If you are the parent or guardian of a minor who has provided us with their data, you may contact us to request its deletion.
14. Your rights
With regard to your personal data, you may exercise the following rights: access; rectification; erasure; restriction of processing; portability; objection to processing based on legitimate interest; objection to direct marketing, at any time and free of charge; withdrawal of consent, without affecting the lawfulness of processing carried out before withdrawal.
To exercise these rights, you may write to info@aurealuxurylab.com or to the address indicated in section 16. Before acting on your request, we may need to verify your identity. We will respond within one month of receipt, a period that may be extended in the cases provided for by law. You may appoint an authorised agent, who must provide proof of the mandate received.
Exercising your rights will not have any adverse consequences for you.
15. Complaints
If you believe that the processing of your personal data infringes applicable law, you may lodge a complaint with the competent supervisory authority. In Italy, the authority is the Garante per la protezione dei dati personali (Italian Data Protection Authority), located at Piazza Venezia 11, 00187 Roma, www.garanteprivacy.it
In any case, we invite you to contact us first, so that we can look into your report.
16. Changes to this Policy
We may update this Policy to reflect changes to our practices or for operational, legal or regulatory reasons. The updated version is published on the site with the date of the last update. Where required by law, we will inform you by means of a specific communication.
17. Contacts
Aurea Luxury Lab S.r.l.
Via Armando Pica 170/E 41121 Modena (MO), Italy
info@aurealuxurylab.com
PEC aurealuxurylab@postecertifica.it