Need help?

AC CREATIVITY S.r.l. — Manila Grace

Information on the processing of personal data — Articles 13 and 14 GDPR

This information is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and Legislative Decree 196/2003 and subsequent amendments (“Privacy Code”) to users interacting with the e-commerce website accessible at manilagrace.com (hereinafter the “Site”). It is understood that this information concerns only the Site and not any third-party websites consulted via hypertext links.

The Data Controller is AC Creativity S.r.l., with registered office in Via Gaetano Ferraiolo n. 62, 80047 San Giuseppe Vesuviano (NA), Tax Code/VAT no. 08332271215, in the person of its pro tempore legal representative Mr. Antonio Casillo (hereinafter also the “Controller” or the “Company”).

To exercise the rights indicated below and for any matter relating to the processing of personal data, you can write to privacy@manilagrace.com.

The Controller has not appointed a Data Protection Officer (DPO), as the mandatory conditions referred to in Art. 37 of the GDPR do not apply; however, it has identified an internal contact person for data protection matters.

In the context of using the Site, the Controller processes: browsing data (IP address, device identifiers, technical logs, data collected via cookies and similar technologies, as indicated in the Cookie Policy); identification and contact data (name, surname, email address, phone number, delivery and billing address); data relating to orders and payments (products purchased, amounts, payment methods; card and payment instrument data are processed directly by payment service providers and are not stored by the Controller); account data for any reserved area; data relating to marketing preferences and interactions, where the data subject gives their consent.

Personal data are processed for the purposes and on the legal bases indicated below:

Purpose	Legal Basis
Conclusion and execution of the sales contract, management of orders, shipments and assistance	Execution of contract — Art. 6, par. 1, lett. b) GDPR
Management of account and reserved area	Execution of contract — Art. 6, par. 1, lett. b) GDPR
Responding to requests submitted via the contact form	Pre-contractual measures / execution of contract — Art. 6, par. 1, lett. b) GDPR
Fulfilment of legal, tax and accounting obligations	Legal obligation — Art. 6, par. 1, lett. c) GDPR
Sending promotional communications and newsletters	Consent — Art. 6, par. 1, lett. a) GDPR
Profiling and segmentation of marketing communications	Consent — Art. 6, par. 1, lett. a) GDPR
Cookies and statistical and marketing tracking tools	Consent — Art. 6, par. 1, lett. a) GDPR (see Cookie Policy)
Management of online withdrawal pursuant to Art. 54-bis Consumer Code and storage of related logs for evidentiary purposes	Legal obligation — Art. 6, par. 1, lett. c) GDPR
Ascertainment, exercise or defence of a right in judicial proceedings	Legitimate interest — Art. 6, par. 1, lett. f) GDPR

Processing is carried out primarily with electronic tools, according to logic related to the indicated purposes and with adequate technical and organizational measures to ensure the security, confidentiality, and integrity of data pursuant to Art. 32 of the GDPR. The Site is built and managed on the Shopify platform.

Data may be disclosed to subjects operating on behalf of the Controller as data processors pursuant to Art. 28 of the GDPR, or to independent controllers, within the following categories:

Recipient Category	Subject
E-commerce platform and hosting	Shopify International Ltd (Ireland) and its sub-processors
Email campaign and newsletter management	Mailchimp (Intuit Inc.)
Advertising, analytics and measurement	Meta Platforms, Google, TikTok
Messaging and support	WhatsApp (Meta Platforms)
Consent Management (CMP)	Complianz (by iubenda)
Payment services	Shopify Payments, PayPal, Klarna
Shipping and logistics	BRT S.p.A. (Italy), UPS (international)
Website development and technical maintenance	Turnup communication

Data may also be communicated to the competent authorities in compliance with legal obligations. The updated list of data processors is available upon request from the Data Controller.

Some of the aforementioned subjects may process personal data outside the European Economic Area. In such cases, the transfer takes place on the basis of an adequacy decision by the European Commission, where applicable (including, for certified US entities, the EU-U.S. Data Privacy Framework), or by signing the Standard Contractual Clauses adopted by the European Commission, supplemented by additional measures where necessary.

Data relating to orders and tax documentation are retained for the period required by law (normally 10 years). Account data is retained until the account is deleted by the user. Data processed for marketing purposes are retained until consent is withdrawn and, in any case, no longer than 24 months from the last useful interaction; data processed for profiling and segmentation purposes are retained for no longer than 12 months, after which they are deleted or consent is renewed. Browsing data is retained for a limited period, unless it is necessary to ascertain crimes.

The data subject may exercise the rights provided for in Articles 15 to 22 of the GDPR at any time: access, rectification, erasure, restriction, portability, objection, as well as the right to withdraw consent at any time, without prejudice to the lawfulness of processing based on consent before its withdrawal. The data subject also has the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

The provision of data necessary for the execution of the contract and legal obligations is mandatory; failure to provide them prevents the completion of the purchase. The provision of data for marketing purposes is optional and refusal does not affect the possibility of purchasing.

The Data Controller reserves the right to modify this policy; updated versions will be published on the Website.

Last updated: June 11, 2026.