Privacy Policy of exton.it

Last update: September 9, 2025

This privacy notice describes the processing of personal data carried out by Exton S.r.l. (hereinafter, the “Controller”) through the website and online shop exton.it (hereinafter, the “Application”).

1) Who processes your data

Data controller: Exton S.r.l., Via Casignano, 81032 Carinaro (CE), VAT IT03351470616
Contact email:  customer@exton.it

2) Types of data processed

  • Identification and contact data: first name, last name, email, phone number.

  • Communication contents: messages sent via forms, emails, and support channels (e.g., WhatsApp).

  • Browsing and usage data: IP addresses, logs, online identifiers, device and interaction information; also collected through cookies/tracking tools.

  • Account data: credentials, preferences, order history.

  • Payment data: tokens and information necessary for payment execution (managed by payment service providers).

  • Data from third-party forms and widgets (e.g., JotForm).

Providing the data necessary for purchase/support is mandatory: without it, it will not be possible to provide the requested service. Providing data for marketing/profiling is optional.

3) Purposes and legal bases of processing

For each purpose, we indicate the legal basis uniformly.

  1. Order management, product/service delivery, account registration and customer support
    (Legal basis: performance of a contract or pre-contractual measures; legitimate interest in the efficient management of customer care).

  2. Payment management via Google Pay and PayPal
    (Legal basis: contract execution; legal obligations in accounting/tax matters). Payment data is processed directly by the respective providers.

  3. Service communications and response to requests (email, forms, WhatsApp Business customer support)
    (Legal basis: contract execution and/or legitimate interest to respond to requests).

  4. Sending newsletters and mailing lists via Klaviyo
    (Legal basis: consent of the data subject; revocable at any time).

  5. Marketing, remarketing, and behavioral advertising through VIADS ADVERTISING, Viralize, VisitIQ, Meta Events Manager and Meta Pixel, WhatsApp Business for direct marketing
    (Legal basis: consent for cookies/profiling; legitimate interest for communications to customers about similar products/services, within legal limits and with the right to object).

  6. Statistics and measurements (Meta Events Manager), A/B testing (Visual Website Optimizer)
    (Legal basis: consent for non-technical tools; legitimate interest for aggregated analysis and site security, where compatible).

  7. Site security, abuse prevention, and legal protection
    (Legal basis: legitimate interest of the Data Controller; legal obligation where applicable).

  8. Legal, tax, and accounting compliance
    (Legal basis: legal obligation).

Cookie preferences and consents can be managed by the user through the appropriate banner/tool and browser settings. Further details on blocking interest-based ads are described in the Cookie Policy of the site.

4) Suppliers and services used (third parties)

  • Platform and hosting: Shopify – provides the shop infrastructure and may process tracking tools and technical data as a controller.

  • Email marketing and contact management: Klaviyo – sending newsletters and automations.

  • Payments: Google Pay, PayPal – directly process payment data as independent controllers.

  • Support/Live chat: WhatsApp Business (widget and support channel) – processes data such as messages, profile, sending times.

  • Data collection/forms: JotForm – acquisition of entered data and usage data.

  • Advertising and profiling: VIADS ADVERTISING, Viralize, VisitIQ, Meta Events Manager and Meta Pixel.

  • A/B testing: Visual Website Optimizer.

Complete information is available on the websites of the respective suppliers. Some may operate outside the EU/EEA.

5) Processing methods

Processing is carried out with electronic tools and security measures adequate to protect the integrity, confidentiality, and availability of data. Data is processed by authorized personnel and by suppliers appointed as responsible where required.

6) Data retention

  • Purchase and billing data: up to 10 years (civil and tax obligations).

  • Customer account: for the entire duration of the account and up to 24 months of inactivity.

  • Support and requests: up to 24 months from the closure of the case, except for disputes.

  • Newsletter/marketing: until consent withdrawal or 24 months from the last useful interaction.

  • Technical logs and security: generally 6–12 months, unless further needs arise.

  • Cookies/tracking IDs: according to the durations indicated in the banner and in the Cookie Policy.

7) Data recipients

Categories: IT and platform providers (e.g. Shopify), payment providers, marketing/advertising and analytics services, consultants and professionals (e.g. accountants, legal), competent authorities when required.

8) Extra EU/EEA transfers

Some providers may involve transfers to countries outside the European Economic Area (e.g. United States). In such cases, the Controller ensures the presence of adequate safeguards pursuant to Articles 44–49 GDPR (e.g. Standard Contractual Clauses), where necessary, or the existence of another legal basis for the transfer. Copies or information about the safeguards can be requested from the Controller.

9) Data subject rights

You can exercise the following rights at any time, within the limits and conditions of the law:

  • Access, rectification, deletion, restriction of processing;

  • Data portability;

  • Opposition to processing based on legitimate interest and, for marketing, at any time;

  • Withdrawal of consent (what has already been processed remains lawful).
    To exercise your rights, write to exton@exton.it.
    You also have the right to file a complaint with the Data Protection Authority.

10) Profiling and automated decisions

Advertising/remarketing activities may involve profiling to show you content and offers aligned with your interests. No automated decisions producing legal effects or similarly significant impacts on the person are adopted.

11) Minors

The site and services are intended for persons over 16 years old. If data from minors is collected, the Data Controller will promptly delete it, subject to legal obligations.

12) Cookies and tracking

This site uses cookies and similar tools including third-party ones. Your choices can be managed through the dedicated banner and browser settings. Further details are provided in the site's Cookie Policy.

13) Updates to the privacy notice

The Data Controller may modify this privacy notice to adapt it to regulatory or technical developments. The latest version is always the one published on this page.