Privacy Policy

Dear User,

This policy describes how the website https://www.turtlesup.com (hereinafter also referred to as the “Site”) processes the personal data of visitors and/or users (hereinafter also referred to as “Data”) who visit or access the Site’s services, in accordance with the European data protection legislation, EU Regulation 2016/679 (hereinafter referred to as the “GDPR”), as well as applicable national legislation, subject to any amendments required by European or national legislative changes and/or decisions by regulatory authorities after the publication of this notice.

Sunnyside S.r.l., as the Data Controller (hereinafter also referred to as the “Company” or the “Controller”), is committed to ensuring the privacy and security of each visitor/user’s personal data in line with the GDPR and national privacy regulations.

Unless otherwise specified, this policy is also to be considered an information notice under Article 13 of EU Regulation 2016/679 for those who interact with the services offered via telematic means through the website https://www.turtlesup.com.

Please note that this privacy policy applies only to the website https://www.turtlesup.com and not to third-party websites that may be accessed through hyperlinks (links) present on the Site.

Sunnyside S.r.l. will process only the data you provide, expressly excluding any special categories of data as defined in Article 9(1) of the GDPR.

1. DATA CONTROLLER

The Data Controller is Sunnyside S.r.l., VAT No. 02941600997, info@turtlesup.com, with registered office at Via Corsica 2, Genoa, Italy.

2. TYPES OF DATA PROCESSED

• a. Personal data provided by the user
  Includes identifiable personal information such as name, surname, date of birth, residence address, email, phone number, and – upon consent – purchasing habits.
• b. Browsing data
  Collected automatically by IT systems during normal operation, such as IP addresses, domain names of user devices, URI addresses, request time, request method, file size in response, server response codes, user’s operating system, and device environment. These may be used by law enforcement for investigation in case of cybercrime.
• c. Data voluntarily provided by users
  This includes data submitted via email, contact forms, or product order forms.
• d. Data from non-registered users
  Includes browsing data used for navigation improvement, statistics, and content customization, possibly linked with data from registered users for marketing or personalization purposes. Refer to the Cookie Policy for more information.
• e. Data from registered users
  Tracked via an alphanumeric ID to monitor browsing behavior across different devices (PC, smartphone, tablet), allowing personalized product suggestions or marketing follow-ups (e.g., abandoned cart reminders).

With specific consent, purchasing data may also be used for profiling and commercial personalization.

3. LEGAL BASIS AND PURPOSE OF PROCESSING

Your personal data will be processed for:

• a) Managing contact/information requests;
• b) Compliance with legal or regulatory obligations;
• c) Preventing fraud or cybercrime and defending the Company in legal proceedings;
• d) Website navigation and anonymous, aggregated statistical analysis;
• e) Execution of contracts;
• f) Administrative and accounting obligations (e.g., invoice processing);
• g) Customer support and service.

Legal basis:

• a) Based on your request;
• b) Legal obligation;
• c) & d) Legitimate interest;
• e), f), g) Execution of a contract or pre-contractual measures.

Failure to provide data may prevent the Company from fulfilling your request or executing a contract.

4. PROCESSING BASED ON EXPLICIT CONSENT

With your explicit consent and until revoked, your data may also be processed for:

• Marketing purposes: promotional communications (including newsletters) via automated (email, SMS, MMS) and traditional (phone, postal mail) means.
• Profiling: analyzing your preferences and purchases to personalize communications and offers.

Consent is optional and does not affect your access to core services. You can withdraw your consent or unsubscribe at any time through provided links.

5. DATA PROCESSING METHODS

Processing will be carried out in a fair, lawful, and transparent manner using automated tools to store, manage, and transmit data, with appropriate technical and organizational measures to ensure confidentiality, integrity, availability, and security of data systems and services.

6. DATA RETENTION PERIOD

• Data processed under section 3: retained for the contract duration + 10 years
• For contact requests via email or form: retained only until the request is fulfilled, unless a contract is initiated

After these periods, data will be deleted, unless retained for legal disputes or obligations.

7. DATA RECIPIENTS

Your data will not be publicly disclosed, but may be shared with:

• Authorized employees of the Controller
• External parties designated as Data Processors (e.g., IT providers, legal or tax consultants, couriers)
• Banks or credit institutions for payments or credit management
• Authorities with legal rights to access the data

Outside of these cases, no data will be transferred, sold, or communicated without appropriate legal basis or your explicit consent.

8. TRANSFER OF DATA OUTSIDE THE EU

Data may be transferred to countries outside the EU. If the country lacks an adequacy decision by the EU Commission, safeguards under Articles 46 and 47 of the GDPR or exceptions under Article 49 will be used.

9. COOKIES

The Site uses cookies. For more information, see the Cookie Policy.

10. USER RIGHTS

You may exercise the following rights under applicable law (unless limitations apply):

• a) Confirm whether your personal data is being processed
• b) Access your data and information about processing
• c) Request correction of inaccurate data
• d) Request deletion of your data
• e) Request restriction of processing
• f) Object to processing, where applicable
• g) Request data portability
• h) Lodge a complaint with the Data Protection Authority (www.garanteprivacy.it)
• i) Take legal action against a decision by the authority (Art. 78 GDPR)
• l) Take legal action if your rights are violated (Art. 79 GDPR)

To exercise these rights, contact the Controller via email or at the company’s address below.

11. DATA CONTROLLER CONTACT DETAILS

Sunnyside S.r.l.
Via Corsica 2, Genoa – Italy
Email: info@turtlesup.com

12. UPDATES TO THIS POLICY

The Data Controller reserves the right to modify, update, or amend this Privacy Policy in accordance with applicable regulations or decisions from the Data Protection Authority.
Please check this page regularly for updates.

Last update: May 15, 2025