Legal

The Data Controller is BROKEN HEARTS S.R.L. (VAT IT11026411212), with registered office at Centro Orafo Oromare, S.P. 22 Km 1,750, 81025 Marcianise (CE), Italy, and operational headquarters in Naples.

For any requests regarding the processing of personal data, you can contact the Controller at: support@brokenhearts.co

Data Voluntarily Provided

• Identification data: first name, last name
• Contact data: email address, phone number
• Address: shipping and billing address
• Payment data: managed exclusively by certified third-party providers (Shopify Payments, Klarna, etc.)
• Communications: content of emails and messages sent to the concierge

Data Collected Automatically

• Technical data: IP address, browser type, operating system, device used
• Navigation data: pages visited, time spent, navigation path
• Interaction data: clicks, scrolls, interactions with site elements
• Cookies and similar technologies: as described in our Cookie Policy

Contract Performance (Art. 6.1.b GDPR)

• Order and shipping management
• Payment processing
• Pre and post-sale concierge
• Returns, refunds and warranty management
• Order-related communications

Legal Obligations (Art. 6.1.c GDPR)

• Tax and accounting compliance
• Mandatory document retention
• Response to judicial or administrative authority requests

Legitimate Interest (Art. 6.1.f GDPR)

• Fraud and illegal activity prevention
• Improvement of our products and services
• Aggregate and anonymized statistical analysis
• Website and IT systems security

Consent (Art. 6.1.a GDPR)

• Newsletter and commercial communications
• Use of profiling and marketing cookies
• Data sharing with partners for promotional purposes

Personal data may be shared with the following categories of recipients:

Service Providers

• E-commerce platform: Shopify Inc. (data processor)
• Carriers: UPS, BRT, DHL, Poste Italiane for order delivery
• Payment providers: Shopify Payments, Klarna for transaction processing
• Email marketing: Klaviyo for newsletter sending (with consent)
• Analytics services: Google Analytics for site usage statistics

Advertising Platforms

• Meta: Facebook/Instagram Pixel for advertising campaigns (with consent)
• TikTok: TikTok Pixel for advertising campaigns (with consent)

Other Recipients

• Competent authorities: when required by law or to protect our rights
• Professional consultants: accountants, lawyers, for specific compliance

We do not sell or rent personal data to third parties for direct marketing purposes.

Some of our service providers are located outside the European Economic Area (EEA), particularly in the United States (Shopify, Google, Meta, Klaviyo).

In such cases, data transfers are based on:

• Adequacy decisions by the European Commission
• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data Privacy Framework EU-US for certified providers

For more information on the safeguards adopted, you can contact us at support@brokenhearts.co.

Personal data is retained for the time strictly necessary for the purposes for which it was collected:

• Order-related data: 10 years from order date (tax and accounting obligations)
• Account data: until account deletion by the user
• Direct marketing data: until consent withdrawal or for a maximum of 24 months from last interaction
• Navigation data: according to durations specified in the Cookie Policy
• Dispute management data: for the time necessary for resolution and in any case not beyond legal limitation periods

At the end of the retention period, data is deleted or irreversibly anonymized.

Under the GDPR, as a data subject you have the right to:

• Access (Art. 15): obtain confirmation of processing and a copy of your personal data
• Rectification (Art. 16): correct inaccurate data or complete incomplete data
• Erasure (Art. 17): request deletion of your data ("right to be forgotten")
• Restriction (Art. 18): restrict processing in certain cases
• Portability (Art. 20): receive your data in a structured format and transfer it to another controller
• Objection (Art. 21): object to processing for direct marketing purposes
• Withdraw consent (Art. 7): withdraw given consent at any time

How to Exercise Your Rights

To exercise your rights, you can contact us at: support@brokenhearts.co

We will respond to your request within 30 days. For complex or numerous requests, this period may be extended by a further 60 days, with prior notice.

Complaint to Supervisory Authority

You also have the right to lodge a complaint with the Italian Data Protection Authority: www.garanteprivacy.it

We implement appropriate technical and organizational measures to protect personal data from unauthorized access, loss, destruction or alteration:

• Encryption: all communications occur via HTTPS/TLS protocol
• Limited access: data is accessible only to authorized personnel
• Secure hosting: data is hosted on certified servers (Shopify is SOC 1, SOC 2 and PCI DSS compliant)
• Backup: regular backups with disaster recovery procedures
• Monitoring: monitoring systems to detect suspicious activity

Payment card data never passes through our systems but is managed directly by PCI DSS certified payment providers.

Our Site and services are not intended for minors under 16 years of age. We do not knowingly collect personal data from minors.

If a parent or guardian believes their child has provided us with personal data without consent, please contact us at support@brokenhearts.co and we will promptly delete it.

We reserve the right to modify this Privacy Policy at any time. Changes will be published on this page with indication of the update date.

In case of substantial changes that significantly affect data processing, we will inform you via email or prominent notice on the Site.

We encourage you to periodically review this page to stay informed about our privacy practices.

For any questions regarding this Privacy Policy or the processing of your personal data:

Data Controller: Broken Hearts

Location: Naples, Italy

Email: support@brokenhearts.co

Hours: Monday–Friday, 9:00 AM–6:00 PM CET

This section applies to anyone who sends us an application, including an unsolicited one, from the Careers page or by writing to support@brokenhearts.co.

Data: what you send us: name, contact details, city, CV, cover letter or message, work, portfolio and the links you give us. We only look at the online profiles you point us to, and only for what concerns your work.

Purposes: assessing your application, replying to you and contacting you again if a suitable role opens within the retention period.

Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR). For unsolicited CVs no consent is required (Art. 111-bis, Italian Legislative Decree 196/2003).

Data we do not ask for: a photo of you, date of birth, marital or family status, pregnancy, health, political opinions, religious or philosophical beliefs, trade union membership, racial or ethnic origin, current or past pay. If your CV contains them, we do not use them (Art. 8, Italian Law 300/1970; Art. 113, Legislative Decree 196/2003; Garante decision no. 146 of June 5, 2019, Annex 1, point 1.4.1). Special categories of data only where essential and required by law (Art. 9(2)(b) GDPR).

Providing data: optional. Without a contact and something of your work we cannot assess the application.

Who sees them: the people at the maison who handle applications, authorized and instructed; our email provider, with data centers in the European Union, and Shopify if you use the form on the site, as processors (Art. 28 GDPR). No publication, no sale, no use for newsletters, advertising or profiling.

Transfers: see section 5.

Retention: 24 months from our last contact, then deletion. If we hire you, the data move to your personnel file under a separate notice. You can ask for earlier deletion at any time.

Automated decisions: none. A person reads every application (Art. 22 GDPR).

Rights: access, rectification, erasure, restriction and portability (Arts. 15-20 GDPR), by writing to support@brokenhearts.co; complaint to the Garante (section 7).