Privacy Policy

Last updated: August 2026

1. Data controller

SecondlifeRetrogame — Corso della Repubblica, 20/22 — 20822 Seveso — (MB) — P.IVA: 04872510963
Email: secondlife.seveso@gmail.com

2. Data collected

We collect the data you voluntarily provide during registration and checkout (first name, last name, email, address, phone), the preferences you set in your profile (wishlist, newsletter subscription, billing address) and the technical browsing data needed to operate the site.

3. Processing purposes

  • Management of orders and shipments
  • Order-related communications
  • Newsletter (only with explicit consent)
  • Tax and legal obligations

4. Legal basis

We process your data on different legal bases depending on the purpose:

  • Performance of the sales contract (art. 6(1)(b) GDPR) — handling orders, shipments, returns and support.
  • Legal obligation (art. 6(1)(c) GDPR) — retention of tax and accounting records.
  • Consent (art. 6(1)(a) GDPR) — newsletter subscription and back-in-stock alerts for wishlist items. You can withdraw it at any time.
  • Legitimate interest (art. 6(1)(f) GDPR) — site security, payment fraud prevention and protecting forms from spam.

5. Data recipients

Your data is never sold or disclosed to third parties for marketing purposes. It is processed on our behalf, as data processors, by the providers that allow us to run the service:

  • Supabase — database, authentication and image storage, on servers located in the European Union (Ireland)
  • Vercel — site hosting and technical logs
  • Stripe — payment processing and fraud prevention
  • Resend — sending service emails: order confirmations, shipping notices, returns handling
  • hCaptcha — protecting the login, registration and contact forms from automated access
  • Express courier — name, address and phone number, for delivery only
  • Accounting firm — tax documents, for statutory compliance

6. Transfers outside the European Union

Some of the providers listed above — Stripe, Resend, hCaptcha and Vercel — are based in the United States. Transfers rely on the safeguards set out in Chapter V of the GDPR: standard contractual clauses approved by the European Commission and, where applicable, the provider's certification under the Data Privacy Framework.

The database holding customer records, orders and wishlists is hosted on servers located in the European Union.

7. Retention

We keep data for as long as needed for the purposes it was collected for:

  • Order and billing data — 10 years, for tax and accounting obligations.
  • Account data and wishlist — for as long as the account remains active.
  • Newsletter subscription — until you withdraw your consent.

When you delete your account we erase your profile and wishlist. The data contained in completed orders is instead retained for the period required by tax law: this is the limitation set out in art. 17(3)(b) GDPR, under which the legal obligation prevails over the right to erasure.

8. Your rights

You may exercise the rights of access, rectification, erasure, portability and objection by writing to: secondlife.seveso@gmail.com

Where processing is based on consent you can withdraw it at any time, without affecting the lawfulness of processing carried out before the withdrawal.

The data requested at checkout is necessary to complete the purchase: without it we cannot fulfil the order. Newsletter data is optional and not subscribing has no consequences.

We do not carry out automated decision-making producing legal effects concerning you. Fraud and spam checks run automatically but do not on their own cause an order to be refused.

9. Complaint to the supervisory authority

If you believe the processing of your data infringes the GDPR you have the right to lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it) or with the supervisory authority of the EU country where you habitually reside.

10. Cookies

For detailed information on the use of cookies, see our Cookie Policy.