Privacy policy

Last updated: October 9, 2026

1. Data Controller 

The Data Controller is Gilas, owned by Chiara Lamberti, with registered office at Via delle Rose 16, 40136 Bologna (IT), VAT No. 04361951207, which can be contacted via email at support@gilasbrand.com and, for formal communications, via certified email (PEC) at chiara.lamberti@arubapec.it.  

2. General Overview & Services Offered 

Gilas operates this store and website, including all related information, content, features, tools, products, and services, in order to provide you, the customer, with a curated shopping experience (the "Services"). Gilas is powered by Shopify, which enables us to provide the Services to you.  

This Privacy Policy describes how we collect, use, and disclose your personal information when you visit, use, or make a purchase or other transaction using the Services or otherwise communicate with us. If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing, and disclosure of your personal information.  

Please read this Privacy Policy carefully. By using and accessing any of the Services, you acknowledge that you have read this Privacy Policy and understand the collection, use, and disclosure of your information as described herein.  

3. Personal Information We Collect  

When we use the term "personal information," we are referring to information that identifies or can reasonably be linked to you or another person. Personal information does not include information that is collected anonymously or that has been de-identified.  

We may collect or process the following categories of personal information depending on how you interact with the Services:  

  • Contact Details: including your name, address, billing address, shipping address, phone number, and email address.  

  • Financial Information: including credit card, debit card, and financial account numbers, payment card information, transaction details, form of payment, payment confirmation, and other payment details.  

  • Account Information: including your username, password, security questions, preferences, and settings.  

  • Transaction Information: including the items you view, put in your cart, add to your wishlist, purchase, return, exchange, or cancel, and your past transactions.  

  • Communications: information you include when communicating with us, such as customer support inquiries.  

  • Device Information: information about your device, browser, network connection, IP address, and other unique identifiers.  

  • Usage Information: information regarding your interaction with and navigation through the Services.  

4. Sources of Personal Information 

We collect personal information from the following sources: 

  • Directly from you: when you create an account, visit or use the Services, communicate with us, or otherwise provide your details.  

  • Automatically: through your device when you browse or use our Services, including via cookies and similar technologies.  

  • Service Providers: third parties engaged to enable technology and process information on our behalf.  

  • Partners and Third Parties: external collaborators and service providers.  

5. Purposes and Legal Bases for Data Processing 

Personal data is processed for the following purposes and legal bases: 

  1. Order Management & Performance of Contract: To manage orders, payments, shipments, returns, and post-sales support, based on the execution of a contract or pre-contractual measures.  

  1. Legal Compliance: To comply with legal, accounting, tax, and administrative obligations.  

  1. Security & Fraud Prevention: To prevent fraud, abuse, and illegal use of the website, as well as to establish, exercise, or defend the Data Controller’s legal claims, based on the legitimate interest of the Data Controller.  

  1. Marketing & Communications: To send promotional communications and newsletters, strictly subject to the prior consent of the data subject where required by law.  

  1. Cookies & Tracking Tools: To use non-necessary cookies and tracking tools, strictly subject to prior consent, in cases provided for by law.   

6. How We Disclose Personal Information 

In certain circumstances, we may disclose your personal information to third parties for legitimate purposes, including: 

  • Shopify and Service Providers: Vendors who perform services on our behalf (IT management, payment processing, data analytics, customer support, cloud storage, fulfillment, and shipping).  

  • Business and Marketing Partners: To deliver marketing services and tailored advertising.  

  • Upon Your Direction or Consent: When you request or authorize disclosure to third parties (e.g., shipping carriers or social media integrations).  

  • Corporate Group & Legal Matters: With affiliates, in connection with business transactions (e.g., mergers), or to comply with legal obligations, enforce terms, and defend rights.  

7. Relationship with Shopify 

The Services are hosted by Shopify, which collects and processes personal information about your access to and use of the Services in order to provide and improve them. Information you submit will be transmitted to and shared with Shopify and third parties in various countries.  

Shopify may also utilize enhanced features incorporating data from your interactions across different merchants. In these instances, Shopify acts as an independent data controller. You can read more via the Shopify Consumer Privacy Policy.  

8. Third-Party Websites and Links  

Our Services may contain links to third-party websites or platforms. We do not control and are not responsible for the privacy practices, security, or content of those external sites. We encourage you to review their respective privacy policies.  

9. Children’s Data 

The Services are not intended for children, and we do not knowingly collect personal information from individuals under the age of majority. If you believe a child has provided us with personal information, please contact us to request its deletion.  

10. Security and Retention of Data 

While we implement safeguards, no security measures are completely impenetrable, and we cannot guarantee absolute security during transit.  

We retain your personal information only as long as necessary to fulfill the purposes outlined in this policy, manage your account, resolve disputes, enforce agreements, or comply with statutory retention requirements.  

11. Your Rights and Choices 

In accordance with applicable data protection legislation, the data subject may exercise the following rights: 

  • Right of Access: Request access to the personal data we hold about you.  

  • Right to Rectification: Request correction of inaccurate or incomplete personal data.  

  • Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data under certain conditions.  

  • Right to Restriction of Processing: Ask us to suspend or restrict the processing of your personal data.  

  • Right to Object: Object to data processing based on legitimate interests or direct marketing purposes.  

  • Right to Data Portability: Receive a copy of your personal data in a structured format or request its transfer to a third party.  

  • Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing prior to withdrawal.  

  • Right to Lodge a Complaint: Lodge a complaint with a competent supervisory authority (such as the Garante per la protezione dei dati personali in Italy or your local EEA supervisory authority).  

Requests to exercise any of these rights may be sent via email to support@gilasbrand.com.  

12. International Data Transfers 

We may transfer, store, and process your personal information outside of your country of residence. When transferring data outside the European Economic Area (EEA) or the United Kingdom, we rely on standard contractual mechanisms (such as the European Commission's Standard Contractual Clauses) or adequacy decisions to ensure an adequate level of data protection.  

 13. Changes to This Privacy Policy 

We may update this Privacy Policy periodically to reflect changes in our operational, legal, or regulatory requirements. Updated versions will be posted on this page with an updated "Last updated" date.  

14. Contact Us 

For any questions regarding this Privacy Policy or to exercise your data protection rights, please contact us at: 

Data Controller: Gilas di Chiara Lamberti  

Address: Via delle Rose 16, 40136 Bologna (IT)  

Email: info@gilasbrand.com