Privacy policy
Effective date and last updated: 21 October 2026
This policy explains how WNN s.r.l. processes your personal data when you visit www.wananluxury.com, buy from us, or contact our customer support by email, contact form or messaging apps. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018 (the "Italian Privacy Code").
1. Controller
WNN s.r.l. — Piazzale Clodio 22, 00195 Rome (RM), Italy — VAT no. IT02619740208
Privacy contact: info@wananluxury.com (please write "Privacy" in the subject line).
We have not appointed a Data Protection Officer: for any question about your data, write to the address above.
2. What data we process
- Identity and contact data: name, surname, email, phone, billing and shipping addresses, account credentials.
- Order data: products bought or returned, order numbers, amounts, discounts, delivery status, invoices.
- Payment data: the method you choose and the outcome of the payment. Card data are entered at checkout and processed by payment providers: we do not store full card numbers.
- Support data: the content of emails, contact-form messages and chats (including attachments, photos or voice notes you send), our replies, date and channel.
- Preferences we derive from your purchases and support requests: brands, sizes and categories you like, products you looked for that were not available, your interest in buying an item, the best time to get back to you, the reasons for your returns, and an internal indicator of how often your orders lead to returns or complaints.
- Browsing data: IP address, browser and device type, approximate location derived from your IP, pages and products viewed, searches, referral source; collected through cookies and similar tools (Section 8).
- Marketing data: newsletter subscription and interactions with our emails (opens, clicks).
- Reviews: text and photos you choose to publish.
Where the data come from. You give them to us (orders, account, messages, reviews); we derive them from your purchases and requests (the preferences); the Site and the tools in Section 8 collect them automatically (browsing data); we receive them from payment providers (payment outcome), couriers (delivery status) and our email provider (interactions with our emails).
Special categories. We do not ask for, or use to build profiles, data about health, ethnic origin, religious beliefs, sexual orientation and the like (Art. 9 GDPR). If you include them in a message, we use them only to answer you.
Mandatory data. The data needed to conclude and perform an order or to answer a request are mandatory: without them we cannot proceed. Other data are optional.
3. Why we process data, and on what legal basis
| # | Purpose | Legal basis |
|---|---|---|
| 1 | Sales: handle orders, payments, shipping, returns and refunds; send confirmations and invoices; manage your account | performance of a contract (Art. 6(1)(b) GDPR) |
| 2 | (a) Customer support: read and answer your messages, handle requests about orders, deliveries and returns | performance of a contract or of pre-contractual steps you request (Art. 6(1)(b)) |
| 3 | (b) Service quality: give our staff the context of your previous requests and, when you ask or when it helps with your request, suggest available alternatives in our reply | our legitimate interest in providing effective support (Art. 6(1)(f)) |
| 4 | (c) Profiling for marketing: use your preferences to make our offers and marketing more relevant and to place you in customer segments (e.g. VIP or business customers) | our legitimate interest in direct marketing (Art. 6(1)(f) and Recital 47 GDPR), with the right to object at any time and without giving reasons (Section 5) |
| 5 | Newsletters and marketing messages | your consent (Art. 6(1)(a) GDPR; Art. 130 Italian Privacy Code); or, if you are already a customer, email about products similar to those you bought (Art. 130(4) Italian Privacy Code), with the option to object in every email |
| 6 | Non-essential cookies and tracking tools (analytics, advertising) | your consent (Art. 122 Italian Privacy Code) |
| 7 | Security and fraud prevention; defence of our rights in legal proceedings | our legitimate interest (Art. 6(1)(f)) |
| 8 | Legal obligations: accounting, tax, requests from authorities | legal obligation (Art. 6(1)(c)) |
For purposes based on legitimate interest (3, 4 and 7) we have carried out a written assessment balancing them against your rights and reasonable expectations; you can request a summary at info@wananluxury.com.
Profiling (4) is not sending (5). Using your preferences to choose what to offer you does not entitle us to write to you: marketing messages are sent only with your consent or, for customers, within the limits of Art. 130(4).
4. Customer support, artificial intelligence and human review
When you write to us, your message reaches our support tools and may be processed, on our behalf and under contract, by service providers, including artificial-intelligence (AI) providers, in order to:
- prepare a draft reply, using the content of your message and your order history;
- update the preferences described in Section 2.
Every reply is read, corrected if needed, and approved by a member of our team before it is sent. No reply is sent automatically. The AI tools decide nothing about you: they assist our staff, who remain responsible for every reply.
No automated decisions. We do not take decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). The internal returns-and-complaints indicator is visible only to our staff as context: it is never used on its own to refuse an order, a return or a refund, and it is not used for marketing. Our e-commerce platform applies limited automated checks against payment fraud (for example, temporarily blocking IP addresses or cards linked to repeated failed attempts).
Under its commercial terms, our AI drafting provider, Anthropic, may not train its models on the content we send it or on the drafts it produces.
WhatsApp. If you write to us on WhatsApp, at the number shown on our Contact information page, your message is also processed by WhatsApp/Meta under its own terms and privacy policy.
5. Profiling and your right to object
We keep a preference profile linked to your email address or phone number, built from your purchases and support requests. We use it in two separate ways: for service (purpose 3) and for marketing (purpose 4). We do not use special categories of data and we take no automated decisions with significant effects.
Objecting to marketing and profiling (Art. 21(2) GDPR). You can object at any time and without giving reasons by writing to info@wananluxury.com with the subject "Objection".
When you object, we delete the marketing profile and keep only your email or phone number on a suppression list, so that we keep respecting your choice. Your support is unaffected.
Objecting to the service use (Art. 21(1) GDPR). On grounds relating to your particular situation, you can also object to the use of your preferences for service (purpose 3), by writing to the same address; we will stop unless we have compelling legitimate grounds, which we will explain to you.
The unsubscribe link in every marketing email stops those emails; to also stop the profiling, write to us as described above.
6. Recipients
Processors (Art. 28 GDPR) acting on our behalf under contract:
- Shopify — e-commerce platform, checkout, order data;
- Re:amaze (GoDaddy) — support email inbox;
- Slack (Salesforce) — internal review and approval of replies;
- Anthropic — AI-assisted drafting;
- Amazon Web Services — processing and storage for our support and search systems (data centre in Ireland);
- Klaviyo — marketing email and segments;
- technical apps that run parts of the Site: Loox (reviews), Navidium (shipping protection; its widget receives your browser's time zone), OXI Social Login (social-account login), PageFly (site pages) and Scalapay (instalment messages on product pages, with the font loaded from Google Fonts: Section 8);
- store-management apps with access to order and customer data: shipping and labels (ShippyPro, Spedire.PRO), shipment tracking (Track123; Synctrack, for tracking codes of PayPal payments), returns (iF returns), cash on delivery (Releasit), order automation, export and printing (Shopify Flow, Mechanic, Matrixify, SC AI Order Taggers, Order Printer Pro, Metafields Guru), sales analytics (Polar Analytics, Glew, Power My Analytics), loyalty programme (Loyal), anti-fraud checks (Blockify), WhatsApp messages (PushDaddy), catalogue publishing (ModeSens).
Independent or joint controllers, each under its own privacy policy:
- payment providers you choose at checkout: card schemes, Mollie (card payments), PayPal, Scalapay (instalments), Revolut (Revolut Pay); for cash on delivery, the courier who collects the amount;
- couriers delivering our orders (currently Poste Italiane, SDA, UPS, DHL and TNT; InPost, if you choose one of its pick-up points), for the order data needed for shipping, delivery and returns;
- advertising and analytics partners (Section 8), for data collected through their tools; for data collected through the Meta pixel we are joint controllers with Meta Platforms Ireland Ltd, under Meta's standard terms (Controller Addendum / Meta Business Tools Terms);
- WhatsApp/Meta, if you contact us on that channel;
- authorities, advisers and professionals (accountants, lawyers), where required by law or to protect our rights.
Data are processed by our authorised and trained staff. We do not publish your data.
7. Transfers outside the European Economic Area
Some providers are based in, or process data in, countries outside the EEA, mainly the United States. On the date of this policy:
- Anthropic: the European Commission's Standard Contractual Clauses (SCC, Art. 46 GDPR), incorporated in its data processing addendum;
- Re:amaze (GoDaddy) and Amazon Web Services: the SCC in their data processing terms and their certification under the EU-U.S. Data Privacy Framework with its UK Extension and the Swiss-U.S. DPF (DPF, adequacy decision, Art. 45 GDPR);
- Slack (Salesforce): its DPF certification;
- Microsoft (Clarity, Section 8): the Standard Contractual Clauses referred to by Microsoft;
- other providers outside the EEA named in this policy: an adequacy decision of the European Commission, the DPF where the provider is certified, or the SCC in its data processing terms.
You can request a copy of the safeguards at info@wananluxury.com.
8. Cookies and tracking tools
We use technical cookies needed for the Site to work, and analytics and advertising cookies and pixels. On the date of this policy, the public pages of the Site use the following tools:
| Purpose | Provider |
|---|---|
| Store, cart, checkout and account; fast checkout and sign-in with Shop; cookie banner | Shopify (including Shop Pay) |
| Analytics | Google Analytics and Google Merchant Center (Google tag); Shopify analytics; Microsoft Clarity (click and scroll heatmaps and anonymous session recordings) |
| Advertising and conversion measurement | Google Ads; Shopify (marketing and sales attribution); Meta (Facebook/Instagram) Pixel; TikTok Pixel; Pinterest Tag; Floodlight tag (Google Campaign Manager) configured for us by our agency Incubeta |
| Email marketing and on-site behaviour for email | Klaviyo (the sign-up form script loads even without consent and stores in your browser only which forms you have already seen and how many pages you have visited, without identifying you; the __kla_id cookie only with your consent) |
| Social-account login | OXI Social Login |
| Reviews | Loox |
| Shipping protection | Navidium |
| Instalment payments | Scalapay (on product pages it loads the Poppins font from Google Fonts: Google receives your IP address) |
| Site pages | PageFly |
Analytics and advertising cookies and pixels run only if you consent through the banner. For Google services we use Google Consent Mode: if you accept only one of the "Analytics" and "Marketing" categories, Google still receives a cookieless signal when you view a page for the other category too, stating that you refused it; if you refuse all, it receives nothing. You can change your choices at any time from the "Cookie preferences" link at the bottom of every page. You can also block or delete cookies in your browser settings. Cookie names, durations and providers are in our Cookie Policy.
9. How long we keep data
| Data | Retention |
|---|---|
| Orders, invoices and accounting records | 10 years (Art. 2220 Italian Civil Code) |
| Account | until you close it |
| Support messages and replies (purpose 2) | up to 24 months from your last interaction with support |
| Preferences used for service (purpose 3) | up to 24 months from your last interaction |
| Marketing profile (purpose 4) | up to 12 months from your last purchase or support contact, or until you object |
| Suppression list | as long as needed to respect your objection (email or phone only) |
| Newsletter subscription | until you withdraw consent or unsubscribe |
| Cookies and pixels | as stated in the Cookie Policy |
We may keep data longer only where needed for a dispute or a legal obligation.
10. Security
We apply technical and organisational measures appropriate to the risk: access limited to staff who need it, encrypted connections, contracts requiring providers to protect data. If a breach affects you, we will inform you where the law requires.
11. Your rights
You can at any time request access to your data, rectification, erasure, restriction of processing, portability, and withdraw consent without affecting earlier processing (Arts. 7 and 15-20 GDPR). You also have the right to object to processing based on legitimate interest and — always and without giving reasons — to direct marketing and related profiling (Art. 21; Section 5).
Write to info@wananluxury.com. We reply within one month, extendable by two months for complex requests; we may ask for information to verify your identity.
Complaints. You can lodge a complaint with the Italian Garante per la protezione dei dati personali (www.garanteprivacy.it) or with the authority of the country where you live or work.
12. Minors
The Site is not intended for individuals under 18 years of age. We do not knowingly collect data from children under 14; if you believe a minor has given us data, write to us and we will delete it.
13. Changes
We may update this policy to reflect changes in our processing or in the law. The new version is published on this page with its new effective date; for material changes we will notify you by email or on the Site.