Privacy Policy – GrotesqueShirts
Last updated: 30 July 2026
This Privacy Policy describes how GrotesqueShirts (“I”, “me”, “my”) collects, uses, and shares personal information when you purchase a product from GrotesqueShirts (the “Site”), contact me, or otherwise interact with the services provided through the Site.
By using this Site, you acknowledge that you have read and understood this Privacy Policy.
1. Data Controller
The data controller is:
Andrea Marchetti
VAT number: 13323740962
Registered office: Piazza Tirana 12, 20147 Milano (MI), Italy
Email: info@grotesqueshirts.com
The data controller is responsible for the processing of personal data collected through this Site.
2. Personal Data Collected
Through the e-commerce platform operated via WooCommerce on WordPress, the following personal data may be collected:
a) Data provided voluntarily by the user
- First and last name
- Billing and shipping address
- Email address
- Telephone number
- Tax code or VAT number (if applicable)
- Additional information included in order notes
b) Payment data
Payments are processed through external payment providers such as Stripe. The data controller does not have access to full payment card details.
c) Technical and browsing data
The Site may automatically collect technical information such as IP address, browser type, device information, operating system, and browsing data necessary for the proper functioning, security, and performance of the website. Cookies and similar technologies are used to ensure essential website functionality, maintain security, process payments, remember user preferences, and, where applicable and subject to your consent, collect analytical or marketing-related information. For further details, please refer to our Cookie Policy.
3. Purpose and Legal Basis of Processing
a) Order management and service provision
To process and fulfil orders, manage shipping, provide customer support, and handle payments and refunds.
Legal basis: Performance of a contract (Art. 6(1)(b) GDPR)
b) Legal and tax obligations
To comply with legal, accounting, and tax obligations.
Legal basis: Legal obligation (Art. 6(1)(c) GDPR)
c) Security and fraud prevention
To ensure website security, protect user accounts and the checkout process, detect malicious activity, prevent automated attacks, and prevent fraudulent or unlawful activities.
Legal basis: Legitimate interest (Art. 6(1)(f) GDPR)
4. Data Retention
- Order and billing data: up to 10 years (tax obligations)
- Customer accounts: until deletion request
- Technical data: as long as necessary for security and functionality
5. Data Sharing with Third Parties
Personal data may be shared only where necessary to provide our services, comply with legal obligations, or protect the security and integrity of the website. Service providers may process personal data on our behalf only to the extent necessary for the services they provide.
| Service Provider | Purpose |
|---|---|
| Aruba | Website hosting infrastructure |
| Stripe | Payment processing and fraud prevention |
| Printify | Order fulfilment and shipping |
| Defiant, Inc. (Wordfence) | Website security, firewall protection, malware detection and bot prevention |
| Accountants and tax advisors | Legal, accounting and tax compliance |
6. International Data Transfers
Some service providers used by the Site may process personal data outside the European Economic Area (EEA), including in the United States. Where such transfers occur, appropriate safeguards are implemented in accordance with the GDPR, including the use of Standard Contractual Clauses (SCCs) or other legally recognised transfer mechanisms, where applicable.
These safeguards apply to relevant service providers, including Stripe, Printify (where applicable), and Defiant, Inc. (Wordfence).
7. Data Subject Rights
- Right of access
- Right to rectification
- Right to erasure
- Right to restriction of processing
- Right to object
- Right to data portability
- Right to lodge a complaint with a supervisory authority
8. Exercise of Rights
Requests concerning your personal data may be sent to:
info@grotesqueshirts.com
9. Changes to This Privacy Policy
This Privacy Policy may be updated from time to time to reflect changes in applicable legislation, regulatory guidance, or the services used by the Site. Any updates will be published on this page together with the revised “Last updated” date.