Information on the processing of personal data
pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”). Last updated: 12 October 2026
1. Data Controller
The Data Controller is Aboama di Umberto Sercecchi, with registered office at Viale della Resistenza 10, 40026 Imola (BO), Italy, tax code SRCMRT84M24C265V, VAT no. IT03650071206, REA BO53869.
For any request concerning your data you can write to info@aboama.com. No Data Protection Officer (DPO) has been appointed, as this is not mandatory for the Controller.
2. Data processed, purposes and legal bases
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Account registration and management of the “My account” area | First name, last name, e-mail, password (encrypted), addresses | Performance of a contract / pre-contractual measures (Art. 6.1.b) | Until the account is deleted |
| Order management, payment, shipping, support and returns | Personal details, billing and shipping addresses, telephone, e-mail, order content, payment outcome | Performance of a contract (Art. 6.1.b) | Duration of the relationship and, for accounting and tax data, 10 years |
| Tax, accounting and legal obligations (including handling of withdrawal and the legal guarantee) | Order and billing data, withdrawal statements and proof of receipt | Legal obligation (Art. 6.1.c) | 10 years for tax data; withdrawal data for the time needed to handle the refund and the limitation periods |
| Abandoned cart recovery: if you enter your e-mail at checkout without completing the order, we may send you a reminder | E-mail, cart content | Consent (Art. 6.1.a), which can be withdrawn at any time | Up to 30 days after the cart was abandoned |
| Site security, fraud and abuse prevention (firewall, log of access attempts) | IP address, access data, technical logs | Legitimate interest (Art. 6.1.f) | Up to 12 months |
| Site usage statistics (Google Analytics 4) | Online identifiers, pages visited, device data, truncated IP | Consent (Art. 6.1.a), through the cookie banner | Up to 14 months |
| Defence of legal claims | Strictly necessary data | Legitimate interest (Art. 6.1.f) | Until the rights are time-barred |
Providing the data necessary for registration and purchases is mandatory: without it we cannot conclude the contract. Providing data for statistics and cart recovery is optional.
For the use of cookies and similar tools please refer to the Cookie Policy.
3. Recipients of the data
Data may be disclosed, only as far as necessary, to parties acting as data processors or as independent controllers:
- payment service providers: Stripe and PayPal. Card data is entered directly on their platforms and does not pass through or get stored on our servers;
- couriers and carriers in charge of delivery (including BRT, SDA, TNT, UPS, DHL);
- providers of hosting, maintenance and security of the site, and of sending transactional e-mails;
- tax, accounting and legal advisers;
- Google Ireland Ltd, for statistics (only with prior consent);
- public authorities, when required by law.
An updated list of processors is available by writing to info@aboama.com. Data is neither disseminated nor sold to third parties.
4. Transfers outside the European Economic Area
Some providers (for example Google, Stripe, PayPal, UPS and DHL for non-EU shipments) may process data in non-EU countries, in particular in the United States. The transfer takes place on the basis of an adequacy decision (EU-US Data Privacy Framework) or of the standard contractual clauses approved by the European Commission.
5. Your rights
You may at any time request access to your data, rectification, erasure, restriction of processing, objection and data portability (Arts. 15-22 GDPR). Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of the processing carried out before. To exercise your rights write to info@aboama.com; we will reply within one month.
You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) (Piazza Venezia 11, 00187 Rome – www.garanteprivacy.it) or with the authority of the EU country where you live or work.
6. Minors
The site is not aimed at persons under 18 and purchases are reserved to those with legal capacity. If you think a minor has provided us with data, please contact us so that we can delete it.
7. Security
We adopt appropriate technical and organisational measures, including an encrypted connection (HTTPS), firewall, access control and backups.
8. Changes
We may update this notice. The version in force is always the one published on this page, with the date of last update.