Privacy policy

Last updated: 2 September 2026

Privacy policy

This policy explains what personal data we collect when you visit salvatoremotti.com or buy from us, why we collect it, who we share it with, and what you can ask us to do about it. We have tried to write it in plain language rather than in the usual fog.

1. Who is responsible for your data

The data controller is Amar Tasic, sole trader, trading as Salvatore Motti, of Sarajevo 71000, Bosnia and Herzegovina.

For any question about your data, or to exercise any of the rights described below, email info@salvatoremotti.com. We answer within 30 days.

2. What we collect

Order and contact data — name, email address, shipping and billing address, phone number where you give one, order contents and history.
Payment data — handled by our payment provider. We receive confirmation that a payment succeeded, the payment method type and the last four digits of the card. We never see or store your full card number.
Account data — if you create an account: your email, password (stored encrypted by Shopify) and saved addresses.
Communications — the content of emails and messages you send us, and our replies.
Technical and usage data — IP address, browser and device type, pages visited, referring site, and similar information collected through cookies. See section 8.
Marketing data — your email address and consent status if you subscribe to our newsletter.

We do not collect special categories of data (health, religion, political opinion and so on), and we ask you not to send them to us.

3. Why we use it, and on what legal basis

Purpose	Legal basis (GDPR Art. 6)
Taking, producing, shipping and supporting your order	Performance of a contract
Handling returns, refunds and warranty claims	Performance of a contract; legal obligation
Keeping accounting and tax records	Legal obligation
Preventing fraud and securing the site	Legitimate interest in protecting the business and our customers
Analytics and improving the store	Consent (analytics cookies)
Marketing emails	Consent, which you may withdraw at any time
Defending or bringing legal claims	Legitimate interest

We do not carry out automated decision-making or profiling that produces legal effects for you.

4. Who we share it with

We share personal data only with the parties we need to in order to run the shop. Each acts as our processor or, where noted, as an independent controller.

Shopify — hosts the store, processes orders and accounts. Shopify own consumer privacy policy is at shopify.com/legal/privacy/app-users.
Printful — our print-on-demand fulfilment partner. Receives your name, shipping address and order contents in order to produce and ship your order.
Carriers — the postal or courier service delivering your parcel receives your name, address and phone number.
Payment provider — processes your payment and performs fraud checks. It acts as an independent controller of the payment data you enter.
Email service — sends order notifications and, where you have consented, our newsletter.
Authorities and advisers — where we are legally required to disclose, or where necessary to establish or defend legal claims.

We do not sell your personal data, and we do not share it with third parties for their own marketing.

5. International transfers

We are established in Bosnia and Herzegovina, which is outside the European Economic Area and is not currently covered by an EU adequacy decision. Our service providers also process data in the EEA, the United Kingdom and the United States.

Where personal data is transferred out of the EEA or the UK, that transfer is made under the European Commission Standard Contractual Clauses or an equivalent approved safeguard, together with additional technical and organisational measures where appropriate. You may request a copy of the safeguards in place by emailing us.

6. How long we keep it

Order records — for as long as tax and accounting law requires, generally up to 10 years from the end of the financial year.
Account data — until you delete your account or ask us to delete it.
Marketing consent and email address — until you unsubscribe, plus a short suppression record so we do not email you again by mistake.
Support correspondence — up to 3 years after the matter is closed.
Analytics data — up to 14 months, in aggregated form where possible.

7. Your rights

If you are in the EEA or the UK, you have the right to:

access the personal data we hold about you and receive a copy of it;
have inaccurate data corrected;
have your data erased, where we have no continuing legal reason to keep it;
restrict how we process your data, in certain circumstances;
receive your data in a portable, machine-readable format and have it transmitted to another controller;
object to processing based on our legitimate interests, and to object at any time to direct marketing;
withdraw consent at any time, without affecting the lawfulness of processing carried out before you withdrew it.

To exercise any of these, email info@salvatoremotti.com. We may need to verify your identity first. Exercising your rights is free; we may charge a reasonable fee only for requests that are manifestly unfounded or excessive.

You also have the right to lodge a complaint with a supervisory authority — normally the data protection authority in the EU or EEA country where you live, or the Information Commissioner Office in the UK. A list of EEA authorities is available at edpb.europa.eu. We would appreciate the chance to put things right first.

8. Cookies

Cookies are small files stored on your device. We use:

Strictly necessary cookies — to keep your cart, your session and your checkout working. These cannot be switched off and do not require consent.
Analytics cookies — to understand how the store is used, so we can improve it. Set only with your consent.
Marketing cookies — to measure advertising and, where relevant, show you our products elsewhere. Set only with your consent.

You can accept or reject non-essential cookies through the banner shown on your first visit, and change your choice at any time through your browser settings. Blocking strictly necessary cookies will stop the checkout working.

9. Marketing emails

We only send marketing emails to people who have asked for them. Every one carries an unsubscribe link, and unsubscribing takes effect immediately. Unsubscribing does not stop transactional emails about orders you have placed.

10. Security

The site runs over HTTPS, payments are processed by PCI-DSS compliant providers, and access to order data is limited to those who need it. No system is perfectly secure, and we cannot guarantee absolute security — but if a breach occurs that is likely to put your rights at risk, we will notify you and the relevant authority as the law requires.

11. Children

The store is not intended for children and we do not knowingly collect data from anyone under 16. If you believe a child has given us personal data, email us and we will delete it.

12. Changes to this policy

We may update this policy to reflect changes in how we operate or in the law. The current version is always on this page with the date it was last updated. If a change materially affects you, we will tell you by email where we can.