Last updated: 2 November 2026
This notice explains how we process the personal data of people who visit www.vulcancymbals.com, register, buy, write a review, take part in the “Share and save” programme or subscribe to our communications, under Regulation (EU) 2016/679 (“GDPR”) and the Italian Personal Data Protection Code (Legislative Decree 196/2003 as amended by Legislative Decree 101/2018).
1. Data controller
ARMAS srl (trading as Vulcan Cymbals), Via Carnazza, 81 – 95030 Tremestieri Etneo (CT) – Italy, VAT IT05271600875, tax code 05271600875 (“Controller”, “we”).
For any privacy question or request: our contact form or by post to our registered office. We have not appointed a Data Protection Officer, as it is not required for our activity.
2. Data we process
- Browsing data: IP address, date and time, pages requested, browser type, collected by the servers to run and secure the Site.
- Account data: name, surname, email, password (encrypted), phone, billing and delivery addresses, tax code; preferred language; wishlist.
- Retailer data: company name, VAT number, SDI code, PEC, company registration extract, contact person.
- Order data: products, amounts, discount codes used, payment method, payment outcome, transaction number, shipping and tracking data, invoices.
- Payment data: full card details are handled only by payment providers; we receive only the outcome, transaction ID and possibly card type and last 4 digits.
- Requests and support: messages sent through forms, return, warranty and repair requests, with any photos or videos attached.
- Reviews: text, rating, the name you choose to sign with, product and date.
- “Share and save” programme: your personal code, products you share, channel used, purchases generated by your link (product and date only, not your friend’s identity), vouchers issued and used.
- Marketing communications: email, name, language, product categories you select, date and method of consent, any withdrawal; if enabled, email opens and clicks.
- Cookies and similar tools: see the Cookie policy.
We do not process special categories of data (e.g. health data). Please do not include them in your messages.
3. Purposes, legal bases and retention
| Purpose | Legal basis (GDPR) | How long |
|---|---|---|
| a) Creating and managing your account | Performance of contract – Art. 6(1)(b) | Until the account is deleted or after 36 months without sign-ins or orders |
| b) Managing orders, payments, shipping, invoicing | Contract – Art. 6(1)(b); legal obligations – Art. 6(1)(c) | Accounting and tax records: 10 years (Art. 2220 Italian Civil Code); order data in your account: until the account is deleted |
| c) Handling withdrawal, returns, warranty, repairs | Contract and legal obligations – Art. 6(1)(b) and (c) | For the guarantee period (26 months from delivery) and up to 24 months after the case is closed; longer if disputed |
| d) Verifying and managing retailers | Pre-contractual measures and contract – Art. 6(1)(b); legitimate interest in verifying business status – Art. 6(1)(f) | For the whole relationship and 10 years after; rejected requests: 12 months |
| e) Answering messages sent through forms | Pre-contractual measures – Art. 6(1)(b); legitimate interest – Art. 6(1)(f) | Up to 24 months after our reply |
| f) Site security, fraud, spam and abuse prevention | Legitimate interest – Art. 6(1)(f) | Technical and access logs: up to 6 months, unless an incident is investigated |
| g) Asking you for a review by email after purchase | Legitimate interest – Art. 6(1)(f) (request related to the product bought; you can object at any time) | Until the request is sent or you object |
| h) Publishing your review | Performance of the service requested – Art. 6(1)(b) | While the product is listed or until you delete it |
| i) Running the “Share and save” programme | Performance of the accepted rules – Art. 6(1)(b); abuse prevention – Art. 6(1)(f) | Up to 24 months after the last voucher is issued |
| l) Sending newsletters, news, offers and promotions by email (marketing CRM) | Consent (optional) – Art. 6(1)(a) and Art. 130 Italian Privacy Code | Until withdrawn; if you neither open our emails nor buy for 24 months, we ask whether you want to stay subscribed or delete your data. After withdrawal we keep only your email and the withdrawal date as proof of your choice |
| m) Personalising offers based on your purchases and interests (profiling) | Separate optional consent – Art. 6(1)(a) | Until withdrawn and in any case no longer than 12 months from collection of each purchase data item used |
| n) Site usage statistics (Google Analytics 4) | Consent via the cookie banner – Art. 6(1)(a) and Art. 122 Italian Privacy Code | Data in Google Analytics: 14 months |
| o) Complying with legal obligations and authority requests; defending our rights | Legal obligation – Art. 6(1)(c); legitimate interest – Art. 6(1)(f) | As required by law or until proceedings end |
When these periods expire, data is deleted or anonymised.
Legitimate interest. We have assessed that processing based on legitimate interest is necessary, limited and expected by people buying on the Site. You can object at any time (Art. 21 GDPR) via our contact form; for review requests, just use the “don’t ask me for reviews” link in every email.
4. Mandatory and optional data
Data marked as mandatory in forms is needed to complete the purchase, manage the account or answer your request: without it we cannot proceed. Consents for newsletters, profiling and statistics are optional: without them you can still buy and use the Site.
5. How we process data
Data is processed electronically by authorised and trained staff with appropriate security measures: encrypted connection (HTTPS), two-step verification for administration, login attempt protection, backups, encrypted passwords. We do not take decisions based solely on automated processing producing legal effects concerning you (Art. 22 GDPR); payment providers may run their own fraud checks as independent controllers.
6. Who we share data with
We never sell or give data to third parties for their own marketing. We share data only with:
Providers acting on our behalf (processors, Art. 28 GDPR):
- Aruba S.p.A. (Italy) – Site hosting, email, backups;
- Packlink Shipping S.L. (Spain) – Packlink PRO shipping platform;
- the newsletter service provider, once activated – sending newsletters and managing subscriptions (only with your consent);
- Google Ireland Ltd. – Google Analytics 4 (only with your consent);
- Aruba PEC S.p.A. (Aruba e-invoicing) and the company’s accountant – e-invoicing, accounting and tax compliance;
- the appointed technical support providers – technical support for the Site, with access limited to what is needed.
Independent controllers:
- payment providers: Stripe Payments Europe Ltd. (cards), PayPal (Europe) S.à r.l. et Cie, S.C.A., Klarna Bank AB (publ), Banco BPM S.p.A. (bank transfers), under their own privacy notices;
- the carriers chosen for delivery (e.g. BRT, GLS, Poste Italiane, UPS, DHL, FedEx), which receive name, address, phone and email for delivery and tracking notices;
- the Italian Revenue Agency and its e-invoicing exchange system; public authorities when required by law;
- legal advisers, in case of disputes.
The up-to-date list of processors is available on request via the contact form.
7. Transfers outside the European Economic Area
Some providers (e.g. Google, Stripe, PayPal and some email services) may process data in the United States or other non-EEA countries. Such transfers rely on a European Commission adequacy decision (for the US, the EU-U.S. Data Privacy Framework, for certified companies) or on the Commission’s standard contractual clauses. If you order a delivery outside the EU (e.g. Switzerland, United Kingdom, United States, Japan), shipping data is passed to the carrier and to the customs authorities of the destination country as necessary to perform the contract (Art. 49(1)(b) GDPR). You can ask us for a copy of the safeguards used.
8. Your rights
You can request at any time, free of charge:
- access to your data and a copy (Art. 15);
- rectification of inaccurate data (Art. 16);
- erasure (Art. 17), except data we must keep by law;
- restriction of processing (Art. 18);
- portability of data you provided (Art. 20);
- to object to processing based on legitimate interest and, in any case, to marketing (Art. 21);
- to withdraw consent at any time, without affecting the lawfulness of earlier processing (Art. 7(3)).
Use the contact form or your account settings. For newsletters just use the “Unsubscribe” link in every email or the Unsubscribe page. For cookies use the “Cookie settings” link at the bottom of every page. We reply within one month.
You also have the right to lodge a complaint with the Italian Garante per la protezione dei dati personali (www.garanteprivacy.it) or with the authority of the EU country where you live or work.
9. Minors
The Site and purchases are reserved to adults. We do not knowingly collect data from children under 14; if you think a minor has given us data, write to us and we will delete it.
10. Changes
We may update this notice, e.g. if we change providers or services. The last update date is shown at the top; for significant changes we will notify you by email or with a notice on the Site.