Privacy policy
Last updated:
This notice explains how we process the personal data of people who visit re-fe.com (the “Site”) and buy Re-fè products, under Regulation (EU) 2016/679 (“GDPR”).
Data controller
ONOFF SRL, Via Vicenza 4, 31100 Treviso (TV), Italy, VAT IT05537320268. Email: [email protected].
What data we process and why
| Activity | Data | Legal basis | Retention |
|---|---|---|---|
| Order handling, shipping, support and returns | Name, email, phone, shipping and billing addresses, InPost locker or pickup point chosen if any, products bought, VAT number if provided | Performance of contract (art. 6.1.b GDPR) | For the duration of the relationship and up to 10 years for tax and accounting duties |
| Withdrawal through the “Withdraw from the contract here” function | Name, email, order number, products listed, date and time sent, IP address to prevent abuse | Legal obligation (art. 6.1.c GDPR; arts. 52-54-bis Italian Consumer Code) | 10 years with the order data; IP address only as an anti-abuse counter, deleted after it expires (1 hour) |
| Tax and accounting obligations | Order and invoice data | Legal obligation (art. 6.1.c GDPR) | 10 years (art. 2220 Italian Civil Code) |
| Replying to email enquiries | Email address and message | Pre-contractual steps or legitimate interest (art. 6.1.b and 6.1.f GDPR) | As long as needed to handle the request, up to 24 months |
| Cart reminder (if you start payment without completing it and did not choose “no thanks”) | Email, products in the cart, country and postcode, chosen courier and pickup point, shipping address | Legitimate interest (art. 6.1.f GDPR) and art. 130(4) Italian Privacy Code; you can object in the cart or by replying to the email | One email only; data deleted after 30 days |
| Invitation to review the purchase on Trustpilot | Name, email, order number | Legitimate interest in collecting customer feedback (art. 6.1.f GDPR); you can object at any time | One invitation at least 14 days after the purchase and, if you do not open the link, a single reminder 7 days later; invitation data deleted after 60 days |
| Friend code and discount card (only if you request them) | Email, generated friend and discount codes, number of rewards; for the friend using a code: email (to check it is a first order) | Performance of the promotion terms you requested (art. 6.1.b GDPR) | While the code is active, then 24 months |
| Newsletter (only if you subscribe) | Email address | Consent (art. 6.1.a GDPR), withdrawable at any time | Until you unsubscribe |
| Chat with the site assistant (only if you use it) | Messages, uploaded photos (not stored), your email if you leave it, IP address to prevent abuse | Replying to your requests and pre-contractual steps (art. 6.1.b GDPR) | Conversations 30 days, then deleted |
| Measurement of Google Ads and of purchases from our product listings on Google (Merchant Center), only if you accept cookies | Ad or product listing click identifier, pages visited, technical browser data, order number and value, codes of the products purchased (no name or email) | Consent (art. 6.1.a GDPR), withdrawable at any time | Cookies up to 90 days; data in Google Ads according to Google’s retention settings |
| Site security and operation | IP address and technical data in server logs | Legitimate interest in security (art. 6.1.f GDPR) | As set by the hosting provider |
Payment details (card number and similar) are entered directly on Stripe’s secure page and are never transmitted to or stored by us.
Cookies and local storage
The Site uses technical cookies and local storage, needed for it to work, and, only with your consent, Google Ads cookies to know whether a visit or a purchase comes from one of our ads or our product listings on Google. We do not use analytics tools or profile visitors for any other purpose.
On your first visit a banner asks whether you accept Google Ads cookies. Until you choose, and if you reject, the Site does not load any Google script and does not set advertising cookies: you can browse and buy as usual. “Accept” and “Reject” carry the same weight, and closing the banner with the X counts as rejecting. Your choice is saved in your browser for 6 months, then we ask again. You can change it at any time from the Cookie preferences link at the bottom of every page: if you withdraw consent we delete the Google Ads cookies from your browser.
| What | Where | Purpose | Duration | Consent |
|---|---|---|---|---|
| Cart, shipping country and postcode, chosen InPost pickup point (localStorage) | Whole Site | Remember your products, courier and pickup point | Until you empty the cart or clear browser data | Not required (technical) |
| Address, email and reminder discount code (sessionStorage) | Cart | Avoid retyping your details and apply the discount | Until the tab is closed | Not required (technical) |
Friend code or card discount (localStorage refe-promo-ls-v1) |
Cart | Apply the discount at checkout | Until the code expires (up to 90 days) | Not required (technical) |
Assistant chat (localStorage refe-assistant-v1) |
Whole Site | Find your conversation again when you change page | 30 days | Not required (technical) |
Cookie choice (localStorage refe-consent-v1) |
Whole Site | Remember whether you accepted or rejected | 6 months | Not required (technical) |
| Vimeo videos | Home and product pages | Show videos in “Do Not Track” mode (no tracking cookies or analytics) | Session | Not required |
| Stripe Checkout | Payment page (checkout.stripe.com) | Payment and fraud prevention | See Stripe’s privacy notice | Not required (technical) |
Google Ads and Google Merchant Center (_gcl_au, _gcl_aw cookies and Google cookies on google.com and doubleclick.net) |
Whole Site | Link visits and purchases to Re-fè ads and product listings on Google and measure their performance | Up to 90 days | Yes, only if you accept |
Google Ads cookies are managed by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), which acts as an independent controller for some purposes and may transfer data to the United States under the EU-US Data Privacy Framework. Learn more: How Google uses information from sites that use its services and Google Privacy Policy. You can also manage Google ad personalisation in My Ad Center.
AI assistant and chat
If you use the site chat (the bubble at the bottom right or the “Do my capsules fit?” button), the messages you write and the photos you upload are sent to Anthropic, whose Claude AI model generates the reply on our behalf. Quick answers to the most common questions do not use the AI.
- Conversations (text only) are kept on Cloudflare servers for 30 days and then deleted. We do not store photos: they are only used for the reply.
- If you ask to talk to a person, or the assistant cannot answer, the conversation and any photo are forwarded to the Re-fè team via Telegram, so we can reply to you in the chat.
- If you leave your email, we only use it to reply to you.
- In your browser we only save the chat identifier (localStorage), to find the conversation again when you change page.
- Please do not write sensitive data or payment details in the chat.
Cart reminder and reviews
- Cart reminder. When you proceed to payment we save the cart and, if payment has not been completed after about an hour, we send you one email only with a link to resume the order and a discount code. If you complete the purchase, the email is not sent. Above the payment button you can opt out with one click (“no thanks”); you can also object later by replying to the email or writing to [email protected]. We do not send other promotional emails without your consent. Cart data is deleted after 30 days.
- Reviews on Trustpilot. At least 14 days after a purchase we send you an email with a link to review Re-fè on Trustpilot and, if you do not open the link, a single reminder 7 days later. To know whether you opened it, the link goes through our site before taking you to Trustpilot. We do not share your data with Trustpilot: if you choose to leave a review, you do so yourself on the site of Trustpilot A/S (Denmark), which processes data under its privacy notice. Leaving a review is optional and you can ask us not to send the invitation by writing to [email protected].
Who we share data with
Data is processed by us and, on our behalf, by providers acting as processors or independent controllers:
- Stripe Payments Europe Ltd. (Ireland): payments and fraud prevention.
- Cloudflare, Inc.: Site hosting and network protection.
- Poste Italiane S.p.A. and other couriers: parcel delivery.
- Packlink (Auctane): shipment preparation and courier selection.
- InPost: delivery to lockers and pickup points, if you choose this shipping option.
- OpenStreetMap Foundation (United Kingdom): map of pickup points in the cart. The map loads only if you choose delivery to an InPost point; your browser downloads the map images from OpenStreetMap servers, which receive your IP address. The United Kingdom has an adequacy decision from the European Commission.
- Brevo (Sendinblue SAS), France: newsletter, service emails, cart reminder and review invitations.
- Vimeo: videos embedded in the Site.
- Google Ireland Limited (Ireland): Google Ads and Google Merchant Center purchase measurement, only with your consent.
- Anthropic (Claude AI model): assistant replies in the site chat.
- Telegram: forwarding chat conversations to the Re-fè team.
- Our accountant and advisers, for legal obligations.
Some providers may process data outside the European Economic Area (e.g. in the United States); in that case transfers rely on a European Commission adequacy decision (EU-US Data Privacy Framework) or Standard Contractual Clauses. We never sell your data.
External links
The Site links to external services such as Google Forms (to apply for CinCir events), Google Drive (press materials) and our social profiles. When you use them, your data is processed under their own privacy notices.
Your rights
You can ask us at any time for access, rectification, erasure, restriction, portability, or object to processing based on legitimate interest (articles 15-22 GDPR), by emailing [email protected]. Where you gave consent you can withdraw it at any time, without affecting prior processing.
You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the authority of your country.
Changes
We may update this notice. The date of the last update is shown at the top.