Privacy policy
in accordance with Art. 13 of Regulation (EU) 2016/679
Last updated: 21 July 2026.
Dear Data Subject,
with this document (the «Privacy Policy»), NORT S.r.l. wishes to renew its commitment to ensuring that the processing of personal data collected through the e-commerce website www.nortbeachwear.com (the «Site» or the «Platform») is carried out in full compliance with the protections and rights recognised by Regulation (EU) 2016/679 («GDPR» or the «Regulation») and by Legislative Decree 196/2003 («Privacy Code»), as amended and supplemented, as well as by any other applicable data-protection legislation.
The term personal data refers to the definition set out in Article 4(1) of the Regulation, namely any information relating to an identified or identifiable natural person (the «Personal Data»).
This Privacy Policy, drawn up on the basis of the principle of transparency and including all the elements required by Art. 13 of the Regulation, is intended to provide, in a simple and intuitive manner, all the information necessary for Personal Data to be provided in an informed and conscious manner.
THE DATA CONTROLLER
The Data Controller, i.e. the party that determines the purposes and means of the processing, is NORT S.r.l., with registered office at Via della Scrofa 117, 00186 Rome (Italy), registered with the Companies Register of Rome, Tax Code and VAT no. 15431241007, REA no. RM-1589913, certified e-mail (PEC) nortsrl@legalmail.it, e-mail: info@nortbeachwear.com (hereinafter the «Data Controller» or «NORT»).
TYPES OF DATA PROCESSED
The Personal Data collected by the Data Controller in order to pursue the purposes set out below may include:
• identification and contact data: first name, last name, e-mail address, telephone number, account username;
• order and shipping data: delivery and billing address, details of the items purchased, order number, shipment status, courier data;
• payment data: type of payment instrument and outcome of the transaction; card data (PAN, CVV) are never processed directly by the Data Controller, but only by PCI-DSS-certified payment service providers;
• tax data: tax code and/or VAT number, where required to issue an invoice;
• purchase history: orders, returns, refunds, complaints and reviews submitted;
• browsing and behavioural data (subject to consent): items viewed, searches, cart content, preferences, frequency and time of access, page interactions, also collected through behavioural-analytics and session-recording tools;
• technical data: IP address, browser and device type, operating system, online identifiers and Tracking Tools, for which reference is made to the Cookie Policy.
Providing the data necessary to perform the contract and to comply with legal obligations is mandatory: without it the Data Controller cannot process the order. Providing browsing and behavioural data is optional and subject to consent.
PURPOSES OF THE PROCESSING AND LEGAL BASES
Personal Data is processed for the purposes and on the legal bases set out below.
a) Improving the browsing experience and monitoring the proper functioning of the Site
The information systems and software used to operate the Platform acquire, in their normal course of operation, certain data whose transmission is implicit in the use of Internet communication protocols (e.g. IP address, operating system, access time, pages visited). Such data is used in aggregate form and to ensure the security of the Platform. The legal basis is the Data Controller’s legitimate interest in the proper functioning and security of its systems (Art. 6(1)(f) GDPR).
b) Enabling the purchase of products and managing the order
Personal Data is necessary to complete transactions and to manage shipping, returns, warranty and after-sales assistance. The legal basis is the performance of the contract to which the Data Subject is party, or of pre-contractual measures taken at their request (Art. 6(1)(b) GDPR).
c) Complying with accounting, tax and legal obligations
The legal basis is compliance with legal obligations to which the Data Controller is subject (Art. 6(1)(c) GDPR; Art. 2220 of the Civil Code and applicable tax legislation).
d) Preventing fraud and unlawful conduct; ensuring transaction security
The legal basis is the legitimate interest of the Data Controller and of customers in the security of online purchases (Art. 6(1)(f) GDPR).
e) Ascertaining, exercising or defending a right in and out of court
The legal basis is the Data Controller’s legitimate interest (Art. 6(1)(f) GDPR).
f) Direct marketing of similar products (soft-spam)
Where the Data Controller uses the e-mail address provided by the Data Subject in the context of the sale of a product, it may send promotional communications concerning its own products or services similar to those purchased, without prior consent, pursuant to Art. 130(4) of the Privacy Code. The Data Subject is informed of this option at the time of collection and in every communication, and may object at any time, easily and free of charge, without prejudice to the commercial relationship. The legal basis is the Data Controller’s legitimate interest (Art. 6(1)(f) GDPR in conjunction with Art. 130(4) of the Privacy Code).
g) Sending promotional communications and newsletters by automated means
Sending commercial communications and advertising material by e-mail, SMS, push notifications and similar tools (including through the email-marketing platform used by the Data Controller) is based on the Data Subject’s optional, freely given and revocable consent (Art. 6(1)(a) GDPR).
h) Profiling and behavioural advertising
With the Data Subject’s consent, the Data Controller analyses habits, preferences and behaviour inferred from browsing on the Site, also by means of behavioural-analytics and session-recording tools, cookies and third-party advertising pixels, in order to build a commercial profile and send personalised communications and advertisements, including on third-party platforms (remarketing). The legal basis is the optional, freely given and revocable consent (Art. 6(1)(a) GDPR). For details of the tools used, please refer to the Cookie Policy.
i) Creating an account and managing the restricted area
Personal Data is used to create and manage the account. The legal basis is the performance of the service contract requested by the Data Subject (Art. 6(1)(b) GDPR).
j) Managing contact and assistance requests
Data is processed to handle requests for assistance and information. The legal basis is the performance of pre-contractual measures or of the contract to which the Data Subject is party (Art. 6(1)(b) GDPR).
Consent is free, optional and revocable at any time, without prejudice to the lawfulness of processing based on consent given before withdrawal. Consent may be withdrawn by contacting the Data Controller at the details set out in this Privacy Policy or, for Tracking Tools, through the cookie preferences panel.
RECIPIENTS AND CATEGORIES OF RECIPIENTS
Personal Data may be processed by staff expressly authorised to do so (Art. 29 of the Regulation and Art. 2-quaterdecies of the Privacy Code) and disclosed to third parties appointed as data processors (Art. 28 of the Regulation) or acting as independent controllers. By way of example, the categories of recipients are:
• the provider of the e-commerce platform, hosting and cloud infrastructure (Shopify);
• payment service providers (PSPs) and instalment-payment solutions, PCI-DSS-certified, including card schemes, digital wallets and Klarna;
• logistics operators and couriers in charge of delivery;
• providers of email-marketing and contact-management (CRM) services;
• providers of statistical-analysis, behavioural-analytics and session-recording services;
• providers of advertising and conversion-measurement services (including Google, Meta and TikTok);
• providers of ancillary Site features (e.g. size guide, product reviews, post-purchase offers);
• professionals, advisors and authorities whose right of access to the data is recognised by law or by orders of the competent authorities;
• parties acquiring, or resulting from extraordinary transactions concerning, the Data Controller’s business.
Personal Data is not disseminated to undetermined parties. An up-to-date list of data processors is available on request.
PROCESSING METHODS
Data is processed using electronic and, where necessary, manual tools, with logic strictly related to the purposes and in a manner ensuring its security and confidentiality. Personal Data is kept in a form allowing identification of the Data Subject for no longer than is necessary for the purposes for which it was collected, in accordance with the principles of minimisation and proportionality.
RETENTION PERIODS
Personal Data is retained for the following periods, without prejudice to further retention where necessary to comply with legal obligations, orders of the Authority or to defend a right in court:
• contractual and purchase data: for the duration of the relationship and for 10 years thereafter (Arts. 2220 and 2946 of the Civil Code);
• accounting and tax data: 10 years from the last accounting entry;
• technical browsing data: within the time limits provided by law, where processed for security and detection purposes;
• data for marketing purposes: until consent is withdrawn or objection is exercised, and in any case no longer than 24 months from the last interaction;
• data for profiling purposes: until consent is withdrawn, and in any case no longer than 12 months from the last interaction;
• data relating to contact requests: no longer than 12 months from receipt of the request.
Personal Data is subject to a periodic review, no less frequently than every 12 months, to assess its relevance; where no longer relevant, it is deleted.
TRANSFERS TO THIRD COUNTRIES
Some of the Data Controller’s providers (in particular the analytics, advertising and measurement services of Google, Meta and TikTok, the email-marketing platform and the behavioural-analytics tool) may process Personal Data outside the European Economic Area, in particular in the United States of America.
Such transfers take place where there is an adequacy decision of the European Commission (for operators certified under the EU-US Data Privacy Framework, adequacy decision of 10 July 2023) or, failing that, on the basis of the Standard Contractual Clauses adopted by Implementing Decision (EU) 2021/914 of 4 June 2021, supplemented where necessary by additional measures identified following a Transfer Impact Assessment in accordance with EDPB Recommendations 01/2020, or on the basis of another appropriate safeguard or derogation under Arts. 44-49 GDPR. A copy of the safeguards adopted is available on request.
AUTOMATED DECISION-MAKING
The Data Controller does not carry out solely automated decision-making producing legal effects concerning the Data Subject or similarly significantly affecting them within the meaning of Art. 22 GDPR. Profiling for marketing purposes is carried out only with prior consent and the Data Subject may object or withdraw consent at any time.
RIGHTS OF THE DATA SUBJECT AND HOW TO EXERCISE THEM
The Data Subject has the right to obtain from the Data Controller access to their Personal Data (Art. 15), its rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), as well as the right to data portability (Art. 20) and the right to object to processing based on legitimate interest, including marketing (Art. 21). Where processing is based on consent, the Data Subject may withdraw it at any time, as easily as it was given and without prejudice to the lawfulness of processing prior to withdrawal (Art. 7(3) GDPR).
Requests may be sent to: info@nortbeachwear.com. The Data Controller replies without undue delay and in any case within one month, which may be extended by two months in complex cases.
Without prejudice to any other remedy, the Data Subject also has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Art. 77 GDPR), Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it.
COOKIES AND TRACKING TOOLS
For information on the cookies and other Tracking Tools used by the Site, their purposes, durations and legal bases, and on how to manage consent, please refer to the Cookie Policy, which forms an integral part of this Privacy Policy.
This Privacy Policy may be updated as a result of legal, technological or service changes. The current version is always available on the Site.