Privacy policy

Last updated: 19 September 2026.

Controller and scope

The data controller is SOFIA S.R.L., Italian VAT and tax number 02595470978, registered office at Via Francesco Ferrucci 57, 59100 Prato, Italy. For questions or requests about personal data, contact info@sofiatoscano.com. This notice covers the Sofia Toscano online store, purchases, accounts and enquiries submitted through the website.

Data, sources and purposes

We process information you provide, such as your name, contact details, addresses, enquiries and order information. The website and technical providers may collect device data, IP address, interactions, cookies and information required for security. Payment information is handled by payment providers; do not send card numbers or security codes by email or through support forms.

We use the information necessary to answer enquiries, fulfil orders and manage payments, shipping, returns and accounts on the basis of contract performance or pre-contractual steps you request. Accounting, tax and valid authority requests are handled to comply with legal obligations. Security, fraud prevention and the protection of rights are based on legitimate interests, subject to your rights. We request consent where required for newsletters and non-essential analytics or advertising tools. Consent may be withdrawn without affecting earlier lawful processing.

Information required for an order is necessary to fulfil it. Marketing subscriptions and consent to non-essential cookies are optional.

Services and recipients

Shopify provides the store platform. Shopify Payments and any payment method you choose at checkout process payments. Necessary information may be processed by providers handling shipping and returns, support, transactional email, maintenance and hosting, and by advisers or authorities where required by law.

Sofia Toscano Portal supports store functions, such as enquiries and account features, when used. Shopify translation and automation apps support store management according to enabled functions.

We use Meta's Facebook and Instagram integration, including the Pixel, advanced matching and Conversions API, to measure conversions and advertising activity. Non-essential processing is subject to consent, which can be managed and withdrawn through the banner and Cookie preferences. Google Merchant Center is connected for product catalogue management.

Shopify may also process certain data for its own purposes under its privacy notice. Requests concerning Shopify's processing may also be submitted through Shopify's privacy portal.

Cookies and choices

Necessary cookies enable the store and checkout to work. The banner and Cookie preferences control allow you to manage or withdraw consent to non-essential tools. Declining does not prevent purchases. You may unsubscribe from promotional messages using the email link or by contacting us; necessary order communications will continue.

Retention and transfers

We retain data as necessary for the stated purposes, order and customer relationship management, legal obligations and the protection of rights. Retention criteria depend on the type of data, ongoing relationship, applicable obligations and any disputes. Consent records and preferences are retained to manage and document your choices.

Some providers may process data outside the European Economic Area or United Kingdom. Such transfers must use safeguards required by applicable law, such as adequacy decisions or standard contractual clauses. Contact us for information about safeguards applicable to processing concerning you.

Rights, complaints and updates

Where the law provides, you may request access, rectification, erasure, restriction and portability, and object to processing. You may withdraw consent at any time and complain to the Italian data protection authority or the competent authority in your country. Email info@sofiatoscano.com; we may request proportionate information to verify your identity.

Purchasing services are intended for adults. Contact us if you believe a child provided data without the necessary authorisation. Linked external websites have their own notices. Updates will be published here with a revised date and any legally required notification.