GIOIA SARDA PRIVACY & COOKIE POLICY

Last updated: October 28, 2026

1. Introduction

This Privacy & Cookie Policy describes how Gioia Sarda collects, uses, stores, and protects the personal data of users who visit www.gioiasarda.com, make purchases, create an account, request information, participate in promotional initiatives, or subscribe to marketing communications.

This Privacy Policy is provided in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR), Spanish Organic Law 3/2018 on Personal Data Protection and the Guarantee of Digital Rights (LOPDGDD), the Spanish Law on Information Society Services and Electronic Commerce (LSSI-CE), and other applicable European and national provisions, including relevant Italian legislation where applicable.

This Privacy Policy applies to the Gioia Sarda website and the services directly managed by the Data Controller. External websites accessible through links may be subject to their own privacy policies.

2. Data Controller

The Data Controller responsible for processing personal data is:

Gioia Sarda di Matteo Silanus

Owner: Matteo Silanus, a self-employed professional established for tax purposes in Spain.

Tax Identification Number (NIF): Y0169213Q

Registered Tax Address: Calle Carlos Fuentes, 4, 28047 Madrid, Spain

Email: gioiasardaonline@gmail.com

Telephone and WhatsApp: +39 324 7426529

Website: https://www.gioiasarda.com/

Matteo Silanus determines the purposes and means of processing personal data in connection with Gioia Sarda's business activities.

For any enquiries concerning personal data protection or the exercise of rights under the GDPR, the Data Controller may be contacted at the email address provided above.

No Data Protection Officer (DPO) has been appointed. Privacy-related requests may be addressed directly to the Data Controller.

3. Categories of Personal Data Processed

The following categories of personal data may be collected when using the website and its services.

Identification and Contact Data

First name, last name, email address, telephone number, postal address, shipping and billing addresses, and other information voluntarily provided by the user.

Purchase-Related Data

Products purchased, order amounts, purchase dates, information concerning shipments, payments, returns, refunds, and after-sales customer assistance.

The data required to process payments is also handled by the relevant payment service providers. Gioia Sarda does not need to store full payment card details to manage orders.

Account and Loyalty Programme Data

Registration information, customer preferences, order history, saved products, any wish lists, loyalty points, rewards, and benefits associated with programmes available on the website.

Communication Data

Information submitted through email, WhatsApp, contact forms, customer support requests, reviews, and other direct communications.

Browsing Data

IP address, browser type, operating system, device used, date and time of access, pages visited, and technical information necessary for website operation, security, and performance analysis.

Promotional Communication Data

Email address, newsletter subscription status, consent preferences, and, where permitted by applicable legislation, information relating to email opens and clicks on links included in promotional communications.

Commercial Preference Data

Information relating to purchases, expressed preferences, products of interest, and interactions with the website, to the extent necessary for the stated purposes and in accordance with the applicable legal bases.

Data Related to Promotions and Commercial Initiatives

Information necessary to participate in competitions, promotions, loyalty initiatives, and other programmes that Gioia Sarda may organise.

4. Purposes and Legal Bases for Processing

Personal data is processed for the following purposes.

A. Order Management and Contractual Relationships

Processing purchases, managing payments, shipping products, providing customer assistance, and handling returns, refunds, replacements, and warranties.

Legal basis: performance of a contract or implementation of pre-contractual measures pursuant to Article 6(1)(b) of the GDPR.

B. Account and Loyalty Programme Management

Registering users, managing personal accounts, accumulated points, rewards, exclusive benefits, and requested features.

Legal basis: performance of a contract or implementation of pre-contractual measures, where applicable, pursuant to Article 6(1)(b) of the GDPR.

C. Compliance with Legal Obligations

Managing tax, accounting, and administrative documentation and complying with obligations established by applicable legislation.

Legal basis: Article 6(1)(c) of the GDPR.

D. Customer Assistance and Enquiry Management

Responding to requests for information, providing support with purchases, handling complaints, and managing communications relating to products and services.

Legal basis: performance of pre-contractual or contractual measures, or the Data Controller's legitimate interest in responding to non-contractual enquiries, depending on the circumstances.

E. Security and Fraud Prevention

Protecting the website, preventing unauthorised access, attempted fraud, misuse of services, and other potentially unlawful activities.

Legal basis: the Data Controller's legitimate interest pursuant to Article 6(1)(f) of the GDPR, within the limits permitted by applicable legislation.

F. Newsletters and Promotional Communications

Sending newsletters, information about handcrafted jewellery, new collections, special offers, promotions, commercial initiatives, and communications relating to Gioia Sarda products.

Legal basis: the data subject's consent pursuant to Article 6(1)(a) of the GDPR, except where applicable legislation permits commercial communications to existing customers under the relevant conditions.

G. Tracking of Promotional Communications

Recording email opens and clicks on links contained in messages to measure campaign effectiveness and improve the relevance of communications.

Legal basis: the data subject's consent, where required by applicable data protection and electronic communications legislation.

H. Statistical Analysis and Website Improvement

Analysing website performance, page usage, and the operation of services using statistical tools.

Legal basis: consent, where required, or another appropriate legal basis in cases permitted by applicable legislation.

I. Advertising and Personalisation

Managing advertising campaigns, measuring their results, and providing relevant commercial content, within the limits permitted by the preferences expressed by the user.

Legal basis: consent, where required by applicable legislation for the use of cookies, advertising pixels, and similar technologies.

J. Protection of the Data Controller's Rights

Managing complaints, disputes, and requests, as well as establishing, exercising, or defending legal rights in judicial or extrajudicial proceedings.

Legal basis: the Data Controller's legitimate interest, within the limits established by applicable legislation.

5. Purchase and Payment Management

Gioia Sarda uses the Wix ecommerce platform to manage its product catalogue, orders, customer data, and online sales features.

During a purchase, the information necessary to process the order, arrange shipment, manage payment, and provide customer assistance is collected.

Transaction-related data may also be processed by the payment service providers used on the website.

These providers operate in accordance with their respective contractual terms and privacy policies.

Providing the data necessary to manage an order is essential to complete a purchase.

Failure to provide essential information may prevent the order from being processed correctly.

6. Customer Accounts and Loyalty Programmes

Gioia Sarda may offer users the opportunity to create a personal account and participate in loyalty programmes or initiatives reserved for customers.

The data necessary to manage these services may include identification information, contact details, purchase history, accumulated points, rewards, and expressed preferences.

This information is processed to provide access to the requested services and manage the associated benefits.

Participation in a loyalty programme does not automatically constitute consent to receive promotional communications, unless such consent is requested and validly obtained or another applicable legal basis exists.

7. Newsletters and Email Marketing Through Klaviyo

Gioia Sarda uses the Klaviyo platform to manage newsletter subscriptions, promotional communications, and automated email marketing activities.

Users may subscribe through the relevant forms available on the website.

Consent to receive promotional communications is recorded through the features provided by Klaviyo.

Communications may concern new products, Sardinian jewellery collections, promotions, commercial initiatives, exclusive benefits for subscribers, and information of interest to customers.

Subscription is voluntary and may be withdrawn at any time using the unsubscribe link included in the communications received.

Withdrawal of marketing consent does not prevent users from receiving communications necessary to manage orders, shipments, or other contractual relationships.

Further information about the platform's data processing practices is available in the Klaviyo Privacy Notice.

8. Consent to Email Open and Click Tracking

Gioia Sarda uses Klaviyo to manage its email marketing communications.

Subject to the data subject's prior consent, where required, information relating to email opens and clicks on links included in messages may be collected.

Email opens may be detected through small graphic elements, commonly known as tracking pixels, embedded in email messages.

Click tracking may be performed through tracked links.

These technologies may make it possible to associate interactions with the recipient's email address and collect technical information relating to the interaction, depending on the features of the service used.

The data collected is used to evaluate campaign effectiveness, analyse recipient engagement, and improve the relevance of promotional communications.

Consent to email open and click tracking is separate from consent to receive newsletters.

Users may therefore subscribe to promotional communications without authorising individual tracking of email opens and link clicks.

Refusing tracking does not prevent users from receiving newsletters or benefiting from offers reserved for subscribers.

Preferences expressed through subscription forms are recorded and managed through Klaviyo, allowing the Data Controller to document the choices made.

Where consent to tracking has not been provided, Klaviyo does not record individual email open or click events for communications subject to those preferences.

Withdrawal of Tracking Consent

Data subjects may withdraw their consent to email open and click tracking at any time without having to unsubscribe from promotional communications.

​

You may modify or withdraw your consent to the tracking of opens and clicks in our emails at any time via the "Manage preferences" link found at the bottom of every communication, without unsubscribing from the newsletter.

Alternatively, you may request to withdraw your consent by writing to gioiasardaonline@gmail.com. The data controller will update your preferences in Klaviyo without undue delay.

​

Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

9. Cookies and Similar Technologies Used by the Website

The website is built using the Wix platform, which uses cookies and similar technologies to ensure website operation, security, session management, and the delivery of features requested by users.

Cookies are small text files stored on a user's device while browsing the website.

They may be temporary, meaning they are deleted at the end of the session, or persistent, meaning they remain stored for a specified period or until deleted by the user.

Essential and Technical Wix Cookies

According to the official Wix platform documentation, standard technical cookies may include the following:

Cookie NamePurposeDuration

XSRF-TOKENProtection against fraud and unauthorised requestsSession

hsPlatform securitySession

svSessionWebsite security, stability, and core functionality12 months

SSR-cachingPerformance and rendering optimisation24 hours

TS*Attack detection and platform protectionSession

bSessionMeasurement of technical system efficiency24 hours

fedops.logger.sessionIdError monitoring and system stability12 months

_wixAB3|*Management of technical platform experiments6 months

server-session-bindAPI protectionSession

client-session-bindAPI protectionSession

oAuthStateIdentification during authentication proceduresSession

wixSessionWebsite security, stability, and core functionality12 months

sec-fetch-unsupportedDetection of browser limitations relating to security featuresSession

This list contains the standard cookies documented by Wix and does not mean that all of them are necessarily present during every website visit.

The actual presence of each cookie depends on the features used, the device, the browser, and the way the website is accessed.

Updated information is available in the official Wix documentation on cookies.

Analytics Cookies

The website may use statistical analysis tools, including Google Analytics where activated, to understand page usage, measure performance, and improve the browsing experience.

Where analytics cookies do not meet the conditions required to be treated as technical cookies, they are used only with the data subject's prior consent.

Marketing and Profiling Cookies

The website may use advertising and measurement tools, including Meta and Google technologies where activated, to measure advertising campaigns and provide relevant commercial content.

Where such tools require consent under applicable legislation, they are activated only after the data subject has made an affirmative choice.

Refusing non-essential cookies does not prevent users from accessing the website's essential features.

Functional Cookies

Some cookies may be used to provide additional features, remember certain preferences, and improve the user experience.

Where these cookies are not strictly necessary, their use takes place in accordance with the preferences expressed by the data subject.

Third-Party Cookies and Technologies

Some website features may be provided by external services or applications integrated into the Wix platform.

These services may use cookies or similar technologies according to their respective purposes and data processing conditions.

The use of technologies requiring consent must respect the preferences expressed by the user.

The type and duration of additional cookies may vary depending on the applications and integrations actually used.

10. Managing and Withdrawing Cookie Consent

Users may express their preferences regarding non-essential cookies through the consent management tools available on the website.

Where provided, these tools allow users to accept or reject optional cookie categories and subsequently modify their preferences.

Cookies may also be managed or deleted through the settings of the user's browser.

Disabling essential technical cookies may affect the proper functioning of certain website features.

Instructions for managing cookies are available on the support pages of the main browsers:

• Google Chrome

• Mozilla Firefox

• Apple Safari

• Microsoft Edge

Preferences regarding website cookies and preferences regarding email communication tracking concern separate activities and may be managed independently.

11. Data Processing Through Wix and Technology Providers

The website is hosted and managed through the Wix platform.

Wix may process data relating to browsing activity, website interactions, accounts, contacts, orders, and the features used.

Processing takes place according to the services activated by the Data Controller and in compliance with the contractual terms and security measures provided by the platform.

Further information about general data processing practices is available in the Wix Privacy Policy.

The website may also use digital analytics and advertising services, including Google and Meta tools, where actually activated.

The use of such services, where it involves processing personal data or installing technologies requiring consent, must respect users' preferences and applicable legal requirements.

Further information is available at:

• Google Privacy Policy

• Meta Privacy Policy

• Klaviyo Privacy Notice

The Data Controller remains responsible for verifying that the technologies used and their settings comply with applicable legislation.

12. Communications Through WhatsApp and Other Channels

Gioia Sarda may receive and manage customer enquiries through email, telephone, WhatsApp, and other available communication channels.

The information submitted is used to respond to enquiries, provide product information, manage orders, and offer customer assistance.

The use of external communication platforms may also involve data processing carried out by the respective providers, in accordance with their terms and privacy policies.

Communications necessary to respond to enquiries or manage purchases are separate from promotional communications, for which applicable legislation is respected.

Further information about data processing by WhatsApp is available in its Privacy Policy.

13. Recipients of Personal Data

Personal data may be disclosed to individuals or organisations providing services necessary for business operations, including:

• Wix, for hosting and technical management of the ecommerce website.

• Klaviyo, for newsletter and promotional communication management.

• Payment service providers.

• Shipping companies and logistics operators.

• Administrative, accounting, tax, and legal advisers.

• IT service providers and technical support professionals.

• Advertising and analytics service providers, where actually used.

• Public authorities and other parties where required by law.

Where applicable, these providers act as data processors pursuant to Article 28 of the GDPR.

Some parties may instead act as independent data controllers, according to their respective purposes and responsibilities.

Personal data is not publicly disclosed indiscriminately or transferred to third parties for purposes incompatible with those stated.

14. Transfers of Personal Data Outside the EU

The use of international technology platforms, including Wix, Klaviyo, and any other providers used, may involve the processing or transfer of personal data outside the European Economic Area.

Such transfers must comply with Chapter V of the GDPR, through adequacy decisions adopted by the European Commission, Standard Contractual Clauses, or other transfer mechanisms recognised by applicable legislation.

The Data Controller adopts or verifies the existence of appropriate safeguards required by law for international data transfers carried out through the services used.

Data subjects may request further information about the applicable safeguards by writing to gioiasardaonline@gmail.com.

15. Data Processing Methods and Security Measures

Personal data is processed using electronic and digital systems and organisational procedures appropriate to the stated purposes.

The Data Controller adopts suitable technical and organisational measures to protect data against unauthorised access, loss, alteration, disclosure, or unlawful use.

Access to information is limited to authorised individuals and service providers who require it to deliver their services.

The measures adopted are assessed in relation to the nature of the data, the purposes of processing, and the associated risks.

16. Personal Data Retention Periods

Personal data is retained for as long as necessary to achieve the purposes for which it was collected, in compliance with legal obligations and the principles of storage limitation and data minimisation.

Order Data and Tax Documentation

Such data is retained for the periods established by applicable civil, tax, and accounting legislation, including obligations under Spanish law and, where relevant, other applicable regulations.

Retention periods may vary depending on the type of document, tax obligations, and any requirements relating to the protection of legal rights.

Account and Loyalty Programme Data

Such data is retained for the duration of the customer relationship and subsequently only to the extent necessary to comply with legal obligations, manage rights, and protect any legitimate interests.

Customer Support Data

Such data is retained for the time necessary to manage requests and subsequently only to the extent required to document the activities performed or protect any applicable rights.

Newsletter Data

Such data is processed for the duration of the subscription, as long as a valid legal basis exists and in accordance with applicable legal limits.

In the event of unsubscription, processing for the purpose of sending promotional communications is discontinued, without prejudice to the possible retention of data strictly necessary to document the withdrawal or prevent further unauthorised communications.

Tracking Consent Data

Consent preferences, withdrawals, and related evidence may be retained for the period necessary to demonstrate compliance with legal obligations and protect the rights of the parties involved.

Browsing Data and Cookies

Wix technical cookies have the retention periods indicated in Section 9.

Additional cookies and third-party technologies are subject to the retention periods established by the respective services and the settings actually adopted.

Data Processed Through Wix, Klaviyo, and Other Services

Retention periods may also depend on the features activated, account settings, contractual obligations, and policies applicable to the respective providers.

The presence of data on these platforms does not automatically justify indefinite retention.

At the end of the applicable retention periods, data is deleted, anonymised, or retained only in cases permitted by law.

17. Data Subject Rights

Pursuant to Articles 15–22 of the GDPR, data subjects may exercise the following rights, where applicable:

• Obtain confirmation as to whether their personal data is being processed and request access to such data.

• Request the rectification of inaccurate data or the completion of incomplete data.

• Request the erasure of their personal data in the cases provided for by law.

• Obtain restriction of processing.

• Object to processing where permitted by law.

• Receive their personal data in a structured, commonly used, and machine-readable format where the conditions for the right to data portability are met.

• Withdraw previously given consent at any time.

• Object at any time to the processing of personal data for direct marketing purposes, including profiling related to such marketing.

• Not be subject to decisions based solely on automated processing in the cases provided for by Article 22 of the GDPR.

To exercise these rights, data subjects may send an email to:

gioiasardaonline@gmail.com

The Data Controller will respond within the time limits established by Article 12 of the GDPR, generally within one month of receiving the request, subject to any extensions permitted by law.

Data subjects also have the right to lodge a complaint with a competent supervisory authority.

Given that the Data Controller is established for tax purposes in Spain, data subjects may contact the Spanish Data Protection Authority (Agencia Española de Protección de Datos, AEPD).

Where the relevant jurisdictional requirements are met, data subjects may also contact the Italian Data Protection Authority (Garante per la protezione dei dati personali) or another competent supervisory authority within the European Union.

18. Processing of Minors' Personal Data

The website is not specifically intended for minors.

Where the processing of personal data is based on consent in connection with the direct offering of information society services to minors, the provisions of Article 8 of the GDPR and relevant national legislation apply.

In Spain, pursuant to Article 7 of Organic Law 3/2018, consent to the processing of personal data belonging to minors under the age of 14 must be provided by the person exercising parental responsibility or guardianship, in the cases governed by that provision.

19. Changes to This Privacy & Cookie Policy

This Privacy Policy may be updated to reflect legal, technical, or organisational changes.

Any significant changes will be communicated to data subjects where required by applicable legislation.

The updated version is available at:

https://www.gioiasarda.com/privacy-policy

Last updated: October 28, 2026.