Privacy policy
PRIVACY POLICY
Last updated: 10 August 2026
This Privacy Policy explains how De Atrium collects, uses, stores and shares personal data when you visit deatrium.com, make a purchase, create an account, subscribe to communications, submit a review or otherwise interact with us.
This notice is provided in accordance with Regulation (EU) 2016/679 (“GDPR”) and other applicable data protection laws. Accessing the website does not in itself constitute consent to every form of processing described below. Where consent is legally required, such as for non-essential cookies or marketing communications, it will be requested separately.
1. Data controller
The data controller is:
De Atrium Società a Responsabilità Limitata Semplificata
Registered office: Via Carlo Farini 52, 20159 Milan (MI), Italy
VAT number and Italian Tax Code: 14333130962
REA number: MI-2775531
Email: support@deatrium.com
Certified email address (PEC): deatrium@legalmail.it
2. Personal data we collect
Depending on how you interact with us, we may collect the following categories of personal data:
Contact and identification data, including your name, email address, telephone number, billing address and delivery address.
Order and transaction data, including products viewed or purchased, order history, returns, refunds, delivery information and payment confirmation.
Payment-related data. Payments are processed by authorised third-party providers. De Atrium does not directly store complete payment card details, but may receive limited information such as the payment method, payment status and transaction reference.
Account data, including login details, saved preferences and information associated with your customer account, where an account is created.
Communications, including messages sent to customer support, professional enquiries, return requests and other correspondence.
Newsletter and marketing data, including your email address, marketing preferences, consent records and interactions with our communications.
Review data, including your display name, email address, rating, review text and any photographs or videos voluntarily submitted through the review service.
Technical and usage data, including IP address, browser and device information, operating system, approximate location, pages viewed, interactions with products, cart and checkout activity, referral source and cookie or similar identifiers.
Fraud-prevention and security data, including information reasonably necessary to identify suspicious transactions, misuse of the website or threats to the security of our services.
3. How we collect personal data
We may collect personal data:
directly from you, when you place an order, create an account, subscribe to communications, contact us, request a return or submit a review;
automatically, when you use the website, through cookies, pixels and similar technologies, subject to your consent where required;
from service providers and commercial partners involved in payments, fulfilment, delivery, analytics, advertising, reviews and fraud prevention;
from social media and advertising platforms when you interact with our content or advertisements, in accordance with your settings on those platforms.
4. Purposes and legal bases
We process personal data for the following purposes and on the following legal bases:
Order management and fulfilment: to process payments, prepare and deliver orders, provide order updates, manage returns and issue refunds. The legal basis is the performance of a contract or taking steps at your request before entering into a contract.
Customer service: to respond to questions, complaints, product enquiries and return requests. The legal basis is the performance of a contract or our legitimate interest in providing effective customer service.
Legal, tax and accounting obligations: to issue and retain invoices, maintain accounting records and respond to lawful requests from authorities. The legal basis is compliance with a legal obligation.
Fraud prevention and security: to verify transactions, detect suspicious activity, protect our customers and secure the website. The legal basis is our legitimate interest in preventing fraud and protecting our business, systems and customers.
Website operation and improvement: to understand technical performance, diagnose problems and improve navigation and services. Where the processing is strictly necessary, the legal basis is our legitimate interest in operating and improving the website. Where non-essential analytics technologies are used, the legal basis is consent.
Marketing communications: to send newsletters and promotional messages. The legal basis is consent, unless another legal basis is expressly permitted by applicable law. Consent can be withdrawn at any time.
Personalised advertising and measurement: to measure campaigns and show advertisements based on interactions with the website. The legal basis is consent where required by law.
Reviews: to collect, verify, manage and display customer reviews. The legal basis is consent where applicable and our legitimate interest in presenting authentic customer feedback and improving our products and services.
Legal claims and business protection: to establish, exercise or defend legal claims and enforce our terms. The legal basis is our legitimate interest and, where applicable, compliance with a legal obligation.
5. Cookies, analytics and advertising
We use essential cookies required for the operation, security and checkout functions of the website.
With your consent, we may also use analytics and marketing technologies provided by Shopify, Google, Meta and Pinterest to understand website use, measure advertising performance and provide more relevant communications.
Consent can be granted, refused or withdrawn through the cookie banner or cookie-preference controls available on the website. Withdrawing consent does not affect processing carried out before its withdrawal.
Further information about the technologies used is available in our Cookie Policy.
6. Service providers and recipients
We may disclose personal data only where necessary and proportionate to the services provided. Recipients may include:
Shopify, which hosts and operates the online store and provides services including checkout, customer accounts, forms, messaging, analytics and fraud prevention;
payment providers, including Shopify Payments, PayPal and other payment methods selected during checkout;
logistics and delivery providers, including Sendcloud and the carrier assigned to the shipment, such as BRT or FedEx;
Fordeer and other invoicing or administrative service providers used to create and manage commercial documents;
Judge.me, which provides product-review functionality;
Google, including Google Analytics and services connected to Google & YouTube and Merchant Center;
Meta, including Facebook and Instagram, for advertising measurement and campaign management;
Pinterest, for advertising measurement and campaign management;
professional advisers, including accountants, lawyers and other consultants where necessary;
public authorities, courts or law-enforcement bodies where disclosure is required by law or necessary to protect legal rights.
These providers may process personal data on our behalf as processors or, in certain circumstances, as independent data controllers. Their processing is also governed by their respective privacy notices.
We do not sell personal data in exchange for money.
7. Relationship with Shopify
Our online store is hosted by Shopify. Information submitted through the website is processed by Shopify to provide the ecommerce infrastructure and related services.
Shopify may also process certain data in connection with enhanced analytics, fraud prevention, performance and advertising services. Depending on the specific service, Shopify may act as our processor or as an independent controller.
Further information about Shopify’s processing and the rights available to you can be found at:
https://privacy.shopify.com/en
8. International data transfers
Some service providers may process personal data outside the European Economic Area, including in the United States or Canada.
Where personal data is transferred to a country that has not been recognised as providing an adequate level of protection, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, together with any additional measures required by applicable law.
9. Data retention
We retain personal data only for as long as necessary for the purposes for which it was collected and to comply with legal obligations.
In particular:
order, invoicing, payment and accounting records may be retained for up to 10 years, in accordance with Italian legal and tax requirements;
customer-service correspondence may generally be retained for up to 24 months after the request has been resolved, unless longer retention is necessary in connection with an order, dispute or legal claim;
customer-account data is retained for as long as the account remains active and subsequently for the period necessary to comply with legal obligations or handle claims;
marketing data is retained until consent is withdrawn or the data is no longer necessary for the relevant purpose. We periodically review inactive marketing contacts;
review data may remain published until the review is removed, the consent is withdrawn where applicable, or retention is no longer justified;
technical, security and fraud-prevention data is retained for the period reasonably necessary to investigate and prevent incidents, subject to the retention settings of the relevant service providers;
cookie and advertising data is retained for the periods described in the Cookie Policy or determined through the settings of the relevant provider.
Personal data may be retained for a longer period where necessary to establish, exercise or defend legal claims or comply with an order from a competent authority.
10. Your rights
Subject to the conditions and limitations provided by applicable law, you may have the right to:
obtain confirmation as to whether we process your personal data and request access to it;
request correction of inaccurate or incomplete data;
request deletion of your personal data;
request restriction of processing;
object to processing based on legitimate interests, including profiling;
withdraw consent at any time where processing is based on consent;
receive personal data in a structured, commonly used and machine-readable format and request its transmission to another controller where applicable;
object at any time to direct marketing;
lodge a complaint with a competent data protection authority.
To exercise your rights, contact support@deatrium.com. We may request information reasonably necessary to verify your identity and protect personal data from unauthorised access.
If you are located in Italy, you may lodge a complaint with the Garante per la protezione dei dati personali:
You may also contact the supervisory authority of the country in which you live or work or where the alleged infringement occurred.
11. Automated decision-making
De Atrium does not make decisions based solely on automated processing that produce legal effects or similarly significantly affect customers.
Advertising and analytics providers may use automated technologies to create audiences, measure engagement or personalise advertisements, subject to your consent and the settings available through the relevant platforms.
12. Security
We implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful loss, alteration, unauthorised access, disclosure or misuse.
However, no online transmission or storage system can guarantee absolute security. Customers are responsible for keeping any account credentials confidential and for notifying us if they suspect unauthorised use.
13. Children
The website and online store are not intended for individuals under the age of 18, and we do not knowingly collect personal data from children for commercial purposes.
If you believe that a child has provided personal data to us without appropriate authorisation, please contact support@deatrium.com.
14. Third-party websites
The website may contain links to external websites, social media platforms or services operated by third parties. De Atrium is not responsible for the privacy practices of those third parties, and users are encouraged to review their respective privacy notices.
15. Changes to this Privacy Policy
We may update this Privacy Policy to reflect changes in our practices, services, providers or legal obligations.
The revised version will be published on this page and the “Last updated” date will be amended accordingly. Where required by law, we will provide additional notice or request renewed consent.
16. Contact
For questions about this Privacy Policy or to exercise your data-protection rights, contact:
For formal communications:
