Privacy notice
Last updated: 19 October 2026
This page explains what data we collect when you buy on this site or send us a request, why we need it, how long we keep it and who we share it with. It describes what the site actually does, not a generic template: if we do not do something, it is not written here.
1. Who handles your data
The data controller is Serramento OK di Rusu Dragos Petru & C. S.a.s., selling under the cirmuluz brand, registered office Via Nogarole 50, 37047 San Bonifacio (VR), Italia, Italy, VAT number 04832830238.
For anything about your data write to [email protected]. A person answers, not an automatic form.
No Data Protection Officer (DPO) has been appointed: we are not in any of the cases where Article 37 GDPR makes one mandatory.
2. What data we collect
Only what we need to send the right piece to the right address.
| Data | When we collect it |
|---|---|
| Full name | At checkout, for the order and the shipment |
| Email address | At checkout, to send you the confirmation and the shipping notice |
| Shipping address | At checkout, to deliver the parcel |
| Phone number (optional) | At checkout: couriers use it to announce the delivery |
| Order content | Which products and which options (version, edges, quantity) |
| Note for the workshop | If you write something in the notes field at checkout |
| Language | To write to you in the language you shopped in |
| Custom requests | If you use the request form: name, email, phone and country (optional), the product and configuration you start from, your message and any attachments (photos, drawings, PDFs) |
| Wall beam configurator | If you put a beam from the configurator in the cart: the choices you made (sizes, pockets, slopes, screws, engraving), the technical drawing and the price we showed you. They stay linked to the cart and, if you buy, to the order |
Your card details never pass through us. When you pay you are taken to Stripe's or PayPal's page: they receive number, expiry date and security code directly. Our server only keeps a code saying “this order has been paid”.
We do not ask for your date of birth, we do not profile, we do not buy lists and we do not run behavioural advertising.
3. Why we process it, and on what legal basis
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Making, packing and shipping your order; answering you when you write | Performance of a contract — point (b) |
| Answering a custom request and preparing a quote | Pre-contractual steps taken at your request — point (b) |
| Issuing and keeping tax documents | Legal obligation — point (c) |
| Defending ourselves in a possible dispute, keeping the site secure | Legitimate interest — point (f) |
| Counting visits in aggregate, to understand which pages are useful and whether the site is slow (Cloudflare Web Analytics, no cookies) | Legitimate interest — point (f) |
There is no processing based on consent, because we do not send newsletters and do not use advertising or profiling.
Visit statistics. To know how many people visit the site, which pages they look at and whether they load quickly, we use Cloudflare Web Analytics. When you open a page, a small Cloudflare script sends the page address, the page you came from, your browser and device type and the loading times; Cloudflare works out the country from the connection. It sets no cookies, stores nothing on your device and does not follow you from site to site: we only see overall numbers (for example “120 visits from Italy to the shop page”), never who you are. If we ever introduce tools that need your consent, you will be asked first and this page will change.
Printed QR codes. Our stickers, cards and flyers carry a QR code (for example cirmuluz.com/qr/sticker). When you scan it we record only which print it was, which language we send you to and when: no IP address, no phone data. The cirmuluz_qr cookie remembers that visit for 30 days: if you buy within that time, the order notes which print you came from. We only use it to know which prints work, as overall numbers (legitimate interest, Art. 6(1)(f) GDPR). Visits are kept for two years at most; the note on the order stays with the order. If you delete the cookie, the order carries nothing.
4. How long we keep it
- Order data: ten years from the end of the year of the transaction, because Italian law requires accounting records to be kept that long (Art. 2220 of the Civil Code and tax rules).
- Emails you send us: as long as needed to answer and close the matter, then two years at most.
- Custom requests and their attachments: two years from the last exchange. If the request becomes an order, the order data follows the ten-year rule above. Attachments are kept on our server, not in a public folder: only the workshop can see them.
- Server logs (IP address, date and time, page requested): no longer than thirty days, for security and troubleshooting only.
- Visit statistics: Cloudflare keeps them for the period set by its Web Analytics service; we only receive overall numbers, which cannot identify you.
After these periods the data is deleted or anonymised.
5. Who we share it with
The website and its database run on our own server, in Italy: requests, orders and attachments are kept there, not with a hosting company.
We only share it with those we need to run the site and to get the parcel to you. They process the data on our behalf, as processors under Article 28 GDPR, and cannot use it for their own purposes:
| Who | What for | Where |
|---|---|---|
| Cloudflare, Inc. | Connects our server to the internet and shields it from attacks: the site's pages pass through its network. It also counts visits, in aggregate and without cookies (Web Analytics) | United States |
| Sendinblue SAS (Brevo) | Sends the site's emails: request notices and receipts, order confirmations | France |
| Stripe Payments Europe, Ltd. | Card payments | Ireland |
| PayPal (Europe) S.à r.l. et Cie, S.C.A. | PayPal payments | Luxembourg |
| Poste Italiane S.p.A. | Parcel delivery | Italy |
Our accountant and, should it ever be needed, a lawyer are bound by professional secrecy. Data may also be disclosed to authorities when the law requires it.
We do not sell your data to anyone. We do not hand it to advertising brokers and we do not use it to build profiles.
6. Transfers outside the European Union
The data is stored in Italy, on our own server, and our emails are sent by Brevo, a French company. Part of the data may however also be processed outside the European Union, mainly in the United States: by Cloudflare, a US company whose network the site's pages pass through; by the technical suppliers Brevo relies on; by Stripe and PayPal, for technical and anti-fraud reasons. This only happens with the safeguards required by the GDPR: the European Commission's adequacy decision on the EU-US Data Privacy Framework, for the companies that have joined it, or the standard contractual clauses approved by the Commission.
7. What you can ask for
At any time you have the right to:
- know what data we hold about you and get a copy (access);
- have it corrected if it is wrong or incomplete (rectification);
- have it deleted, unless the law requires us to keep it (erasure);
- ask us to suspend its use while a matter is open (restriction);
- receive it in a machine-readable format (portability);
- object to processing based on our legitimate interest.
Write to [email protected]: we answer within thirty days. If you are not satisfied with the answer you can contact the Italian data protection authority (garanteprivacy.it) or the authority of the country you live in.
8. Do you have to give it to us?
No, but without name, address and email we cannot take the order or ship anything: they are needed to conclude the contract. Phone and workshop note are optional, we only ask because they make delivery easier.
9. Automated decisions
We do not make any. A person looks at every order, one by one: the same person who then makes your piece.
11. Changes
If something changes — a new supplier, a new tool — we update this page and the date at the top. If the change affects you directly, we will email you.