Privacy Policy
This Privacy Policy describes how GrotesqueShirts (“I”, “me”, “my”) collects, uses, and shares personal information when you purchase a product from GrotesqueShirts (the “Site”), contact me, or otherwise interact with the services provided through the Site.
1. Data Controller
The Data Controller is:
- Name: Andrea Marchetti
- VAT number: IT13323740962
- Registered office: Piazza Tirana 12, 20147 Milano (MI), Italy
- Email: info@grotesqueshirts.com
GrotesqueShirts is operated as an individual commercial business. No Data Protection Officer (DPO) has been appointed, as the nature and scale of the processing carried out by GrotesqueShirts do not currently meet the criteria requiring the designation of a DPO under Article 37 GDPR.
2. Personal Data Collected
GrotesqueShirts operates an e-commerce website using WooCommerce on WordPress, hosted on European servers by Aruba S.p.A.
Information you provide: when you place an order or contact me, I may collect your name, billing and shipping address, email address, telephone number, Codice Fiscale or Partita IVA where applicable for Italian fiscal invoicing, and any information you provide in order notes or customer communications.
Payment information: payments are processed through Stripe, LLC via WooCommerce Payments. I do not have access to or store your full payment card details; payment information is processed by Stripe in accordance with its own privacy and security practices.
Technical data: IP address, browser type, device information, timestamps, and other technical information generated through the use of the Site, including information relating to web requests and security events where necessary for the protection and operation of the Site. Such data may be processed by security services, including Wordfence, for purposes such as detecting and preventing malicious activity, unauthorised access, abuse and other security threats.
Cookies and similar technologies: the Site uses cookies and similar technologies. Further information is provided in the dedicated Cookie Policy.
3. Purposes and Legal Bases for Processing
a) Order management and provision of services: processing necessary to receive and manage orders, arrange fulfilment and delivery, process payments, provide customer support, and manage refunds and returns. The legal basis is Article 6(1)(b) GDPR, as processing is necessary for the performance of a contract.
b) Legal and tax obligations: processing necessary to comply with legal, accounting and tax obligations, including obligations relating to fiscal records, the Registro dei Corrispettivi and Fatturazione Elettronica. The legal basis is Article 6(1)(c) GDPR.
c) Site security and infrastructure protection: processing necessary to protect the Site, maintain its security and integrity, detect and prevent malicious activity, unauthorised access, abuse, fraudulent transactions and other security threats. This may involve the processing of technical information such as IP addresses and information relating to web requests and security events, including through security services such as Wordfence. The legal basis is our legitimate interest under Article 6(1)(f) GDPR. This processing is strictly operational and does not involve commercial profiling or behavioural advertising.
d) Visitor source information: the Site may use Sourcebuster JS, including in connection with the MoreConvert Wishlist plugin, to record information about the source of a visitor’s visit, such as referral source, campaign parameters and related visit information. This information is used for internal operational and website-improvement purposes and is not used for behavioural advertising or commercial profiling. Where applicable, the processing is subject to the consent choices managed through the Site’s cookie consent mechanism.
e) Consent-dependent technologies: where required by applicable law, technologies such as Google reCAPTCHA and other non-essential cookies or similar technologies are used only in accordance with the user’s consent choices made through the Site’s cookie consent mechanism. The relevant legal basis is Article 6(1)(a) GDPR where consent is required.
f) Direct marketing: GrotesqueShirts does not currently carry out direct marketing, send newsletters, or use personal data for commercial profiling. If this changes in the future, this Privacy Policy will be updated and any consent required by applicable law will be obtained before such processing takes place.
g) Automated decision-making and profiling: GrotesqueShirts does not carry out automated decision-making, including profiling, that produces legal effects or similarly significant effects on individuals within the meaning of Article 22 GDPR.
4. Minors
The Site is not directed at children under the age of 14. In accordance with Article 2-quinquies of the Italian Data Protection Code and Article 8 GDPR, where processing is based on consent, the consent of a child under the applicable age requirements must be provided or authorised as required by law. If personal data is collected from a child without the required legal basis or consent, I will take reasonable steps to delete it where appropriate.
5. Data Sharing with Third Parties
I may share personal data with third-party service providers where necessary to operate the Site, process orders and payments, fulfil and deliver purchases, provide technical and security services, comply with legal obligations, or otherwise provide the services requested by customers. Where required by applicable law, appropriate data processing agreements or other legally recognised safeguards are put in place with relevant service providers.
| Provider | Purpose | Location |
|---|---|---|
| Aruba S.p.A. | Hosting and server infrastructure | Italy / EU |
| Automattic Inc. (Akismet) | Spam detection and prevention for Site forms and user-generated content | USA |
| Stripe, LLC (via WooCommerce Payments) | Payment processing | USA / international |
| Printify, Inc. and its production/logistics partners | Order fulfilment, manufacturing and shipping | USA / international |
| Google Ireland Limited (Google Fonts) | Font delivery and rendering; depending on the technical configuration, fonts may be served from Google’s infrastructure or from locally hosted copies | Ireland / USA |
| Google Ireland Limited (Google reCAPTCHA) | Bot detection, spam prevention and website security | Ireland / USA |
| Intuition Machines, Inc. (hCaptcha) | Bot detection, spam prevention and protection against automated abuse and fraudulent activity | USA |
| MoreConvert | Wishlist functionality and related website features | Applicable jurisdiction of the service provider |
| Defiant, Inc. (Wordfence) | Website security, firewall protection, malware detection and prevention of malicious or unauthorised activity | USA |
| Complianz B.V. | Cookie consent management | Netherlands / EU |
| Agenzia delle Entrate and appointed tax advisers | Fiscal reporting, accounting and legal compliance | Italy |
Printify acts as a service provider for GrotesqueShirts in connection with order fulfilment, including manufacturing and shipping. Where applicable, Printify’s production and logistics partners may process personal data as downstream providers involved in fulfilling and delivering orders.
6. International Data Transfers
Some third-party service providers used by GrotesqueShirts may process personal data outside the European Economic Area (EEA), including in the United States.
Where personal data is transferred outside the EEA, such transfers are carried out in accordance with the requirements of the GDPR and based on an applicable legal transfer mechanism. Depending on the recipient and the circumstances of the transfer, this may include an adequacy decision of the European Commission, participation in the EU–US Data Privacy Framework where applicable, or the use of Standard Contractual Clauses (SCCs) and other appropriate safeguards recognised under applicable data protection law.
Where required, appropriate contractual, organisational and technical measures are implemented to help protect personal data transferred to recipients outside the EEA.
The specific safeguards applicable to a particular service provider may depend on the services used and the data processing involved.
7. Data Retention
| Data category | Retention period |
|---|---|
| Order and fiscal records (including invoices and receipts) | 10 years, or for the period required by applicable law |
| Customer account data | Until the account is deleted, unless a longer retention period is required by law |
| Technical server logs | Maximum 12 months, unless a longer period is strictly necessary for security, legal or technical reasons |
| Security logs and related technical data | For the period necessary to detect, investigate and prevent security incidents and other malicious activity, in accordance with the principles of data minimisation and storage limitation |
| Cookie consent records | 12 months, or for the period required by the applicable consent-management system |
Where an account is deleted, personal data contained in completed order and fiscal records will be retained for the applicable statutory retention period where required by law. Such data will not be used for unrelated purposes during that period.
8. Data Subject Rights
Under the GDPR, you may have the following rights, subject to applicable legal conditions:
- Right of access (Article 15 GDPR)
- Right to rectification (Article 16 GDPR)
- Right to erasure (Article 17 GDPR)
- Right to restriction of processing (Article 18 GDPR)
- Right to data portability (Article 20 GDPR)
- Right to object (Article 21 GDPR)
- Right to withdraw consent at any time where processing is based on consent
To exercise your rights, please contact me at info@grotesqueshirts.com. I will normally respond within one month. This period may be extended by up to two further months where necessary due to the complexity or number of requests; in such cases, I will inform you within the first month.
9. Supervisory Authority
You have the right to lodge a complaint with a competent supervisory authority. In Italy, the competent authority is:
Garante per la protezione dei dati personali
Piazza Venezia 11
00187 Roma, Italy
www.garanteprivacy.it
You may also contact the supervisory authority in the EU Member State where you habitually reside, work, or where the alleged infringement occurred.
10. Changes to This Privacy Policy
I may update this Privacy Policy from time to time to reflect changes to the Site, the services used, applicable legal requirements, or our data processing practices. Any updates will be published on this page with an updated revision date. Where changes are material, I may provide a more prominent notice on the Site where appropriate.
Last updated: 13 September 2026