Privacy policy
How Flyper S.r.l. processes the personal data of visitors and customers: purposes, legal bases, recipients, retention periods and rights.
- Browse without giving dataYou can view the entire website without registering: there is no account to create.
- No profilingNo behavioural advertising, no statistical analytics, no marketing cookie, from anyone.
- Data only when neededWe ask for it only if you buy, to ship the glasses and take payment, or if you write to us.
- Your card stays with StripeYour card numbers never pass through our systems: they are collected directly by Stripe.
This notice explains what personal data we collect through www.flyper.it, why we collect it, who we share it with, how long we keep it and what you can ask us. It is given under Articles 13 and 14 of Regulation (EU) 2016/679 and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018.
It is written to be read. Where a technical term is unavoidable, we explain it the first time it appears.
01Who processes your data
The data controller is:
- Company
- FLYPER S.r.l.
- Registered office
- Via Umberto I, 25/A
86100 Campobasso (CB)
Italy - Operational office and showroom
- Viale Mazzini, 55
00195 Roma (RM)
Italy - VAT No. and tax code
- 01775190703
- Companies Register
- Campobasso Chamber of Commerce, no. 01775190703
- REA No.
- CB-202713
- Share capital
- €10,000.00 fully paid up
- Certified email (PEC)
- flyper@pec.it
- Telephone
- +39 06 9293 6111
Write to customercare@flyper.it about anything concerning your personal data.
We have not appointed a Data Protection Officer. The conditions of Article 37 GDPR are not met: we are not a public authority, we do not carry out regular and systematic monitoring on a large scale, and we do not process special categories of data on a large scale. If that changes we will appoint one and update this page.
02What happens if you only browse
The pages are static and ask you for nothing. Three things happen anyway, and they are worth knowing.
Server logs
Like any web server, the one hosting this site records the requests it receives: IP address, date and time, page requested, outcome, browser type and operating system. They keep the site running, help diagnose failures, and let us withstand abuse attempts.
Legal basis: legitimate interest in the security and operation of the service (Article 6(1)(f)). Retention: as configured by the hosting provider and in any event no longer than twelve months.
What stays in your browser
The site stores four items in your browser’s local storage, not on a server of ours: the light or dark theme you chose, the language you chose, the currency you chose, and your cart identifier. They are technical and require no consent under Article 122 of Legislative Decree 196/2003. The full list, with durations and purposes, is in Cookie policy.
Typefaces
The pages load their typefaces from our own server. Until September 2026 they came from Google Fonts, which meant Google received your IP address as each page opened, before you had any choice in the matter. That no longer happens.
Opening a page of this site, your browser contacts no third-party domain. The one exception is the checkout page, where the payment form belongs to Stripe: and there the connection exists to carry out the payment you are asking for.
03The processing operations, one by one
For each operation, below, is everything Article 13 requires.
- Why
- Keeping the cart between pages and through to checkout.
- Legal basis
- Pre-contractual steps at your request (Art. 6(1)(b)).
- For how long
- Until the order is placed or the cart is abandoned, and in any event no longer than thirty days.
- Why
- Concluding the contract, shipping the glasses, handling withdrawal, returns and guarantee.
- Legal basis
- Performance of the contract (Art. 6(1)(b)).
- For how long
- Ten years from completion of the transaction, for civil and tax obligations.
- Why
- Taking payment and preventing fraud.
- Legal basis
- Performance of the contract (Art. 6(1)(b)) and legal obligations on fraud and money laundering (Art. 6(1)(c)).
- For how long
- At Stripe, per its own notice. With us, ten years alongside the order.
- Why
- Meeting accounting and tax obligations.
- Legal basis
- Legal obligation (Art. 6(1)(c)).
- For how long
- Ten years, under Article 2220 of the Italian Civil Code and tax law.
- Why
- Answering your request, handling a complaint, a return or a guarantee claim.
- Legal basis
- Performance of the contract (Art. 6(1)(b)) or legitimate interest in replying to people who write to us (Art. 6(1)(f)).
- For how long
- Two years from closure of the request, or ten if it concerns an order.
- Why
- Writing to you when a new numbered series opens. Nothing else.
- Legal basis
- Consent (Art. 6(1)(a) and Article 130 of Legislative Decree 196/2003), withdrawable at any time.
- For how long
- Until consent is withdrawn, and in any event no longer than twenty-four months from the last interaction.
- Why
- Handling a dispute or litigation.
- Legal basis
- Legitimate interest in protecting our rights (Art. 6(1)(f)).
- For how long
- For the duration of the proceedings and the time limits for appeal.
04What we do not do
Worth saying, because many privacy notices describe processing that does not happen, and that is as false as concealing processing that does.
- No profiling. We build no profiles, infer no interests, segment no one.
- No behavioural advertising. No pixel, no tag, no advertising platform, from any provider.
- No analytics tool. The site loads neither Google Analytics nor any equivalent.
- No sale or transfer of data to third parties for their own purposes.
- No social login and no embedded content from third-party platforms. The Instagram link is a plain link: until you press it, Instagram does not know you are here.
- No special categories of data. We sell non-prescription sunglasses: we ask for no prescriptions and process no health data.
05Automated fraud screening
The payment service provider applies automated fraud checks to the transaction, weighing factors such as the card’s country of issue, the consistency between billing and delivery address, and the behaviour of the payment session. The outcome may be an automatic refusal of the transaction, in which case the order is not concluded and no amount is charged.
Under Article 22 GDPR you have the right to obtain human intervention, express your point of view and contest the decision: write to customercare@flyper.it and we will review the case. The detailed logic of the check belongs to the payment provider, which describes it in its own notice; it is not disclosed to us in detail because that would undermine its effectiveness against fraud.
06Who we share data with
With our authorised employees and collaborators, bound by confidentiality, and with the parties below, appointed as processors under Article 28 GDPR except where stated otherwise.
- What they do
- Card payment and fraud screening. Independent controller for the anti-money-laundering obligations imposed on it by law.
- What they receive
- Card details, amount, email, transaction identifiers.
- Where
- EU, with transfer to the United States.
- What they do
- Delivering the parcel.
- What they receive
- Name, address, telephone, email for delivery notifications.
- Where
- EU and country of destination.
- What they do
- Hosts the site, the shop and the order database.
- What they receive
- All of the above data, as held on its servers.
- Where
- European Union.
- What they do
- Bookkeeping and tax compliance.
- What they receive
- Invoicing and order data.
- Where
- Italy.
- What they do
- Only where the law requires it, or where needed to establish, exercise or defend a legal claim.
- What they receive
- Only what is strictly necessary.
- Where
- Italy.
An up-to-date list of appointed processors is available on request at customercare@flyper.it.
We share your data with no one else, and we do not sell, trade or otherwise transfer it.
07Transfers outside the European Economic Area
Data is held on servers in the European Union. A single transfer to the United States takes place, and it is the one set out in section 6: Stripe, for taking payment.
It is to an organisation participating in the EU-U.S. Data Privacy Framework, covered by the European Commission’s adequacy decision of 10 July 2023 (Article 45 GDPR), and is in any event backed by the standard contractual clauses approved by the Commission (Article 46(2)(c)) as an additional safeguard.
You may ask us for a copy of the safeguards applied by writing to customercare@flyper.it.
08Do you have to give us your data?
No, and the consequences differ depending on the data.
- To browse the site: no data is needed.
- To buy: the delivery and payment data are necessary. Without them we cannot conclude the contract, ship, or issue the invoice. That is not our choice: it is the nature of the transaction.
- For the new series alert: entirely optional. If you do not give it, or you withdraw consent, you can buy exactly as before. Nothing follows from it.
09How we protect the data
We apply the technical and organisational measures appropriate to the risk required by Article 32 GDPR: an encrypted connection across the whole site, payment handled by a PCI DSS certified provider without card data touching our systems, access to data limited to authorised people and for no longer than necessary, software components kept updated, and backups.
No measure removes the risk entirely. In the event of a personal data breach likely to result in a high risk to your rights, we will tell you without undue delay as Article 34 GDPR requires, and notify the Italian supervisory authority within seventy-two hours under Article 33.
10Your rights
You may exercise the rights under Articles 15 to 22 GDPR at any time:
- access: to know whether we process data about you and to obtain a copy;
- rectification: to correct inaccurate data or complete incomplete data;
- erasure: to have data deleted, in the cases of Article 17 and subject to statutory retention obligations;
- restriction: to freeze processing in the cases of Article 18;
- portability: to receive the data you provided in a structured, machine-readable format and have it transmitted to another controller;
- objection: to object to processing based on legitimate interest, explaining your particular situation;
- withdrawal of consent: at any time and without giving reasons, where processing rests on consent. Withdrawal does not affect the lawfulness of processing already carried out;
- human intervention in automated decisions, as described in section 5.
Write to customercare@flyper.it. We reply within one month, extendable by two for complex requests, telling you if that happens. Exercising your rights is free; we may charge a reasonable fee only for manifestly unfounded or excessive requests, and if we do we explain why.
To withdraw consent to the new series alert, the unsubscribe link at the foot of every message is enough.
11Complaint to the supervisory authority
If you consider that the processing of your data infringes the GDPR you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it, or with the supervisory authority of the Member State where you live, work or where the alleged infringement took place. Recourse to the courts remains unaffected.
12Changes
If anything changes we update this page and the date at the top. Where a change concerns new purposes or materially affects your rights we tell you before it takes effect, and where necessary we ask for fresh consent.
Earlier versions are available on request.