Privacy Policy

Last updated: 11 August 2026

This Privacy Policy explains how GLUECKLICH OHG DES CHRISTOPH STEINER & CO. (“Glücklich”, “we”, “us” or “our”) collects and processes personal data when you visit gluecklich.it, create a customer account, contact us, subscribe to marketing communications or place an order.

We process personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, the “GDPR”), the applicable Italian data protection legislation and other applicable data protection laws.

This Privacy Policy is intended to provide information about our processing activities. It does not constitute consent to the processing of personal data. Where consent is legally required, we request it separately.

DATA CONTROLLER

The Data Controller responsible for processing personal data through this website is:

GLUECKLICH OHG DES CHRISTOPH STEINER & CO.
Piazza Municipio 11
39057 Appiano sulla Strada del Vino (BZ), Italy
VAT number and tax code: 02803430210
REA: BZ-206971
Email: info@gluecklich.it
Telephone: +39 0471 974989

GLUECKLICH OHG DES CHRISTOPH STEINER & CO. is an Italian general partnership corresponding to a società in nome collettivo (S.n.c.).

PERSONAL DATA WE COLLECT

Depending on how you interact with our website and services, we may collect the following categories of personal data.

a. Information you provide directly

This may include:

• Name and surname
• Billing and shipping address
• Email address
• Telephone number
• Order and purchase information
• Payment-related information
• Customer account and login information
• Newsletter preferences and marketing consent
• Messages and information submitted through contact forms
• Communications with our customer service
• Returns, refunds and complaint information
• Any other information you voluntarily provide to us

Payment information is processed securely by the relevant payment provider. We generally do not receive or store complete payment-card numbers.

b. Information collected automatically

When you visit or use our website, we may automatically collect:

• IP address
• Browser type and version
• Operating system
• Device type and device identifiers
• Language and regional settings
• Referring website or URL
• Pages visited and products viewed
• Date, time and duration of visits
• Shopping-cart and checkout activity
• Cookie identifiers and consent preferences
• Technical logs and security information
• Information about interactions with our website and marketing communications

Some of this information is collected using cookies, pixels and similar technologies. Further information is available in our Cookie Policy and through the cookie-preference tool on our website.

c. Information received from third parties

We may receive personal data from third parties involved in providing our website and services, including:

• Shopify and related e-commerce services
• Payment providers
• Shipping and logistics providers
• Analytics providers
• Advertising and social-media platforms
• Newsletter and marketing-service providers
• Fraud-prevention and security providers
• Customer-service and technical-support providers

The data received depends on the service concerned and your interaction with that provider.

PURPOSES AND LEGAL BASES FOR PROCESSING

We process personal data for the following purposes.

a. Website operation and security

We process technical and usage information to make our website available, maintain its functionality, protect accounts and transactions, detect fraudulent or unauthorised activity and ensure the security of our systems.

Legal basis: our legitimate interests in operating a secure and functional online store, pursuant to Article 6(1)(f) GDPR, and, where applicable, compliance with legal obligations pursuant to Article 6(1)(c) GDPR.

Essential technical data must be processed for the website to function correctly. Without this processing, certain website functions may not be available.

b. Shopping cart, checkout and orders

We process identification, contact, order and transaction information to manage shopping carts, process orders, accept payments, provide order confirmations, arrange delivery, process returns and refunds and fulfil our contractual obligations.

Legal basis: taking steps at your request before entering into a contract and performing our contract with you, pursuant to Article 6(1)(b) GDPR.

Providing the information marked as required during checkout is necessary to conclude and perform the purchase contract. If you do not provide this information, we may be unable to process your order.

c. Payments

We process and transmit payment-related information to the payment provider selected during checkout to authorise and complete payments, prevent fraud and process refunds.

Legal basis: performance of a contract pursuant to Article 6(1)(b) GDPR, compliance with legal obligations pursuant to Article 6(1)(c) GDPR and our legitimate interest in preventing fraudulent transactions pursuant to Article 6(1)(f) GDPR.

Payment providers may process certain information as independent data controllers in accordance with their own privacy policies.

d. Shipping and delivery

We provide the information necessary to deliver your order to the selected shipping or logistics provider. This normally includes your name, delivery address, contact details and relevant order information.

Legal basis: performance of a contract pursuant to Article 6(1)(b) GDPR.

e. Customer accounts

If you create a customer account, we process your identification, contact, login and order information to provide and manage the account, display your order history and facilitate future purchases.

Legal basis: performance of a contract and taking steps at your request pursuant to Article 6(1)(b) GDPR.

Providing data for a customer account is voluntary. You can generally purchase without maintaining a customer account unless otherwise indicated during checkout.

f. Customer service and enquiries

We process personal data to respond to enquiries, provide customer support, handle complaints and manage returns, refunds or other requests.

Depending on the nature of the request, the legal basis is taking pre-contractual steps or performing a contract pursuant to Article 6(1)(b) GDPR, compliance with a legal obligation pursuant to Article 6(1)(c) GDPR or our legitimate interest in responding to enquiries and providing customer service pursuant to Article 6(1)(f) GDPR.

If you do not provide the information required to process your request, we may be unable to respond or provide the requested assistance.

g. Accounting, taxation and legal compliance

We process order, payment, invoice and transaction information to comply with accounting, taxation, commercial and other legal obligations.

Legal basis: compliance with legal obligations pursuant to Article 6(1)(c) GDPR.

h. Newsletter and promotional communications

If you subscribe to our newsletter or otherwise agree to receive promotional communications, we process your name, email address, preferences and information about your interaction with our communications to send you news, offers and information about our products and services.

Legal basis: your consent pursuant to Article 6(1)(a) GDPR.

Providing data for marketing is voluntary and is not required to make a purchase. You may withdraw your consent at any time by using the unsubscribe link in an email or contacting us at info@gluecklich.it.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

Where permitted by applicable Italian law, we may send existing customers marketing communications by email concerning products similar to those previously purchased. You may object to these communications at any time, free of charge.

i. Analytics and website improvement

Subject to your cookie preferences, we may process information about website visits, product views, interactions and purchases to understand how visitors use our website, measure its performance and improve our products, services and customer experience.

Where information is collected through non-essential analytics cookies or comparable tracking technologies, the legal basis is your consent pursuant to Article 6(1)(a) GDPR.

You can withdraw or change your consent at any time through the cookie-preference tool.

j. Personalised advertising and campaign measurement

Subject to your consent, we may use cookies, pixels and similar technologies to measure advertising performance, build audiences and show advertising that may be more relevant to your interests on other websites and platforms.

This may involve sharing online identifiers, cookie information, device information, website interactions and purchase-related events with advertising partners such as Google and Meta.

Legal basis: your consent pursuant to Article 6(1)(a) GDPR.

You can withdraw or change your consent at any time through the cookie-preference tool.

k. Fraud prevention and legal claims

We may process personal data to detect, investigate and prevent fraud, misuse, security incidents and violations of our terms, and to establish, exercise or defend legal claims.

Legal basis: our legitimate interests in protecting our business, customers, systems and legal rights pursuant to Article 6(1)(f) GDPR and, where applicable, compliance with legal obligations pursuant to Article 6(1)(c) GDPR.

COOKIES AND SIMILAR TECHNOLOGIES

We use cookies and similar technologies to:

• Provide essential website and checkout functionality
• Remember settings and cookie preferences
• Maintain security and prevent fraud
• Measure website traffic and performance
• Understand how visitors use our website
• Measure advertising campaigns
• Personalise content and advertising

Strictly necessary cookies may be used without consent where they are required to provide the website or a service expressly requested by you.

Non-essential analytics, advertising and profiling cookies are used only after obtaining consent where required by law.

You can accept, reject or manage non-essential cookies through the cookie banner and cookie-preference tool on our website. You may withdraw or modify your consent at any time.

Disabling essential cookies through your browser may prevent parts of the website, account or checkout from functioning correctly.

Further information about individual cookies, providers, purposes and storage periods is available in our Cookie Policy and cookie-preference tool.

RECIPIENTS OF PERSONAL DATA

We may disclose personal data to recipients where necessary to operate our website, provide our services, fulfil orders, comply with legal obligations or protect our legitimate interests.

Recipients may include:

• Shopify, which provides our e-commerce platform and related services
• Shopify Payments and other payment providers selected during checkout
• Stripe and PayPal, where the respective payment method is available and selected
• Shipping, delivery and logistics providers
• Klaviyo or another newsletter provider used to send marketing communications
• Google, where Google Analytics, Google Ads or related services are enabled with your consent
• Meta, where Meta advertising and measurement services are enabled with your consent
• Website hosting, IT, cybersecurity and technical-support providers
• Customer-service, return-management and communication providers
• Accountants, tax advisers, legal advisers and other professional consultants
• Banks, insurers and fraud-prevention providers
• Public authorities, courts, regulators and law-enforcement bodies where disclosure is legally required
• Potential purchasers or advisers in connection with a merger, restructuring, sale or transfer of all or part of our business, subject to appropriate confidentiality safeguards

Depending on the relevant service and processing activity, these recipients may act as processors on our instructions or as independent data controllers.

We do not sell personal data for monetary consideration.

SHOPIFY

Our online store is hosted and operated using Shopify. Shopify processes personal data to provide the online store, account, checkout, order-management and related e-commerce services.

For customers located in the European Economic Area, the United Kingdom and Switzerland, personal data is generally initially processed by Shopify International Limited in Ireland. Shopify affiliates and subprocessors may also process personal data in other countries.

Further information about Shopify’s processing practices is available in Shopify’s privacy documentation.

INTERNATIONAL DATA TRANSFERS

Some of our service providers, their affiliates or subprocessors may process personal data outside the European Union or European Economic Area.

Where personal data is transferred to a country outside the EU or EEA, we ensure that an appropriate transfer mechanism is used as required by GDPR. Depending on the recipient and destination, this may include:

• An adequacy decision adopted by the European Commission
• The EU–US Data Privacy Framework, where applicable
• Standard Contractual Clauses approved by the European Commission
• Supplementary technical, contractual and organisational safeguards
• Another transfer mechanism or derogation permitted under GDPR

You may contact us at info@gluecklich.it to request further information about international transfers and the safeguards applied.

DATA RETENTION

We retain personal data only for as long as necessary for the purpose for which it was collected and to comply with legal, accounting, taxation and documentation obligations.

The applicable retention periods include:

• Order, invoice, payment and accounting data: generally 10 years, or for a longer period if required by law or necessary in connection with legal proceedings
• Customer account data: for as long as the account remains active and thereafter where retention is required for orders, legal obligations or legal claims
• Customer-service communications: for the time necessary to address the request and thereafter for the applicable limitation period where required to document the matter or protect legal rights
• Marketing data: until consent is withdrawn, an objection is made or the information is no longer required for the relevant marketing purpose
• Records of consent, withdrawal and objections: for as long as necessary to demonstrate compliance with our legal obligations and defend potential claims
• Technical and security logs: for the period reasonably necessary to maintain website and system security, investigate incidents and prevent fraud
• Cookie and analytics data: for the periods indicated in our Cookie Policy and cookie-preference tool
• Data connected with legal claims: until the matter is concluded and the applicable limitation periods have expired

After the applicable retention period, personal data is deleted, anonymised or securely restricted unless further retention is required by law.

YOUR DATA PROTECTION RIGHTS

Subject to the conditions and limitations established by GDPR, you have the right to:

• Request confirmation as to whether we process your personal data
• Obtain access to your personal data and receive a copy
• Request correction of inaccurate or incomplete personal data
• Request erasure of personal data
• Request restriction of processing
• Receive personal data you provided in a structured, commonly used and machine-readable format and, where applicable, transmit it to another controller
• Object to processing based on our legitimate interests
• Object at any time to direct marketing, including related profiling
• Withdraw consent at any time where processing is based on consent
• Obtain information about safeguards used for international transfers
• Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects, except where legally permitted
• Lodge a complaint with a competent data protection authority

To exercise your rights, contact:

Email: info@gluecklich.it

We may request additional information where reasonably necessary to verify your identity and protect personal data against unauthorised disclosure.

We will respond without undue delay and generally within one month of receiving your request. This period may be extended by two additional months where permitted by GDPR, taking into account the complexity and number of requests. We will inform you if an extension is necessary.

Exercising your rights is generally free of charge. Where a request is manifestly unfounded or excessive, particularly because it is repetitive, we may charge a reasonable fee or refuse to act as permitted by law.

RIGHT TO LODGE A COMPLAINT

You have the right to lodge a complaint with the Italian Data Protection Authority:

Garante per la Protezione dei Dati Personali
Piazza Venezia 11
00187 Rome, Italy
Website: www.garanteprivacy.it

You may also contact the competent data protection authority in the EU or EEA country where you reside, work or believe an infringement occurred.

We encourage you to contact us first at info@gluecklich.it so that we can try to address your concerns directly.

AUTOMATED DECISION-MAKING

We do not use personal data to make decisions based solely on automated processing that produce legal effects or similarly significantly affect you.

Our service providers may use automated systems to detect potentially fraudulent or unauthorised transactions. Where such systems identify a risk, an order or payment may be reviewed, delayed or rejected. Where applicable, you may contact us to request further information or human review.

Advertising and analytics providers may use data, subject to your consent, to create audiences, measure campaigns or personalise advertisements. This does not generally produce legal or similarly significant effects concerning you.

DATA SECURITY

We implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

These measures are selected by taking into account the nature and scope of the processing, the associated risks, the available technology and the costs of implementation.

However, no electronic transmission or storage system can be guaranteed to be completely secure. You are responsible for keeping your account credentials confidential and for notifying us if you suspect unauthorised access to your account.

CHILDREN’S PRIVACY

Our services are not directed at children, and we do not knowingly collect personal data from children in circumstances requiring parental or guardian authorisation.

If you believe that a child has improperly provided us with personal data, please contact us at info@gluecklich.it so that we can investigate and, where appropriate, delete the information.

THIRD-PARTY WEBSITES AND SERVICES

Our website may contain links to third-party websites, social-media platforms or services. We are not responsible for the privacy practices of third parties acting as independent data controllers.

We recommend reviewing the privacy policy of the relevant third party before providing personal data or using its services.

CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy to reflect changes in our services, processing activities, technologies or applicable laws.

The current version will be published on this page with the date of the latest update. Where required by law, we will provide additional notice or request renewed consent.

CONTACT INFORMATION

For questions about this Privacy Policy, our processing of personal data or the exercise of your data protection rights, contact: