Privacy Policy

The data controller is: AQuattordici srls Via Giuseppe Mazzini 5 74122 Taranto (TA), Italy VAT: IT03144980731 Email: [email protected]

We collect the following categories of personal data: - Identification data: name, surname, email address (via Manus OAuth authentication) - Browsing data: IP address, browser type, pages visited, date and time of access - Purchase data: shipping address, order history, product preferences - NFC data: NFC tag scans (chip UID, read counter, approximate IP-based location, timestamp) - Technical data: technical and preference cookies (language, theme)

Personal data is processed for the following purposes: - Service delivery: account management, order processing, product authenticity verification via NFC - Security: anomaly detection in NFC scans, counterfeit prevention, anti-fraud protection - Communications: sending order confirmations, shipping updates, service-related notifications - Service improvement: aggregate and anonymized analysis to improve user experience - Legal obligations: compliance with tax, accounting, and regulatory requirements

Data processing is based on: - Contract performance (Art. 6(1)(b) GDPR): for providing requested services and managing orders - Consent (Art. 6(1)(a) GDPR): for non-essential cookies and marketing communications - Legitimate interest (Art. 6(1)(f) GDPR): for service security and counterfeit detection - Legal obligation (Art. 6(1)(c) GDPR): for tax and regulatory compliance

Personal data is retained for the time strictly necessary for the purposes for which it was collected: - Account data: until account deletion by the user - Purchase data: 10 years (Italian tax obligations) - Browsing data: 26 months - NFC scan data: retained indefinitely to ensure product authenticity traceability - Cookies: according to the durations specified in the Cookie Policy

Personal data may be shared with: - Technical service providers: hosting (Manus), payment processing (Stripe), blockchain (Polygon) - Competent authorities: when required by law We do not sell or transfer personal data to third parties for marketing purposes.

Some data may be transferred outside the European Economic Area (EEA) for the use of cloud and blockchain services. In such cases, we adopt adequate safeguards in compliance with the GDPR, including standard contractual clauses approved by the European Commission.

In accordance with the GDPR, users have the right to: - Access: obtain confirmation of processing and a copy of data - Rectification: correct inaccurate or incomplete data - Erasure: request deletion of data ("right to be forgotten") - Restriction: restrict processing in certain circumstances - Portability: receive data in a structured, readable format - Objection: object to processing based on legitimate interest - Withdrawal of consent: withdraw consent at any time To exercise these rights, contact: [email protected] Users also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali — www.garanteprivacy.it).

We adopt appropriate technical and organizational measures to protect personal data, including AES-128 encryption for NFC data, HTTPS connections, secure OAuth authentication, and restricted data access by authorized personnel only.

We reserve the right to update this privacy policy. Changes will be published on this page with an indication of the last update date. Continued use of the service after publication of changes constitutes acceptance thereof.