Privacy policy
Pursuant to Articles 13 and 14 of EU Regulation 2016/679 (GDPR) and Italian Legislative Decree 196/2003 · Updated 13/10/2026
This English text is a courtesy translation. In case of any discrepancy, the Italian version prevails.
This policy explains how we process the personal data of people who visit www.qi-shop.it, buy from the shop or contact us. We have chosen to collect only the data that is strictly necessary: the site does not require you to create an account, does not use profiling cookies and does not send newsletters.
1. Data controller
Registered office: Calatafimi Segesta (TP) — Sicilia, Italia
Tax code: 93073700812 · VAT number: 02938210818
E-mail: info@wbchild.it · PEC: zonar@pec.it · Tel. +39 371 553 4916
Website: www.qi-shop.it
For any privacy request write to info@wbchild.it or by certified e-mail (PEC) to zonar@pec.it. The Controller has not appointed a Data Protection Officer (DPO), as the conditions of Article 37 GDPR do not apply.
2. What data we process and why
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Order management: payment, shipping, customer service, returns, guarantee | First name, last name, e-mail, phone, delivery address, tax code (optional), items purchased | Performance of the contract (Art. 6.1.b) | 10 years from the order, then anonymised |
| Tax and accounting obligations | Order and payment data | Legal obligation (Art. 6.1.c) | 10 years (Art. 2220 Italian Civil Code) |
| Orders started but not paid | Data entered at checkout | Pre-contractual measures (Art. 6.1.b) | 90 days, then deleted |
| Replies to requests sent via the contact form or by e-mail | Name, e-mail, order number, message text | Pre-contractual measures / contract (Art. 6.1.b) | 24 months |
| Site security, fraud and abuse prevention | IP address, date and time, pages requested (server logs) | Legitimate interest (Art. 6.1.f) | Up to 6 months |
| Proof of cookie choices | Anonymous consent code, choices made, truncated IP, browser | Obligation to demonstrate consent (Art. 7.1) | 24 months |
The data marked as mandatory at checkout is needed to ship the order: without it the purchase cannot be completed. Payment card details are entered directly on Stripe's secure page and the Controller never has access to them.
3. Who we share data with
Data is processed by persons authorised by the Controller and, only as far as necessary, by the following parties, acting as processors (Art. 28 GDPR) or as independent controllers:
- Express courier responsible for delivery: name, address and phone number for delivery.
- Stripe Payments Europe Ltd. (Ireland): payment processing and fraud prevention, as an independent controller.
- Aruba S.p.A. (Italy): provider of the server hosting the site.
- The Controller's accountant and advisers, for tax obligations; public authorities, when required by law.
Data is never sold or disclosed to the public.
4. Transfers outside the European Union
Data is stored on servers in Italy. Stripe may also process some data in the United States, on the basis of the EU-U.S. Data Privacy Framework and/or the Standard Contractual Clauses approved by the European Commission (Art. 46 GDPR).
5. Your rights
At any time you can ask the Controller for:
- access to your data and a copy of it (Art. 15);
- rectification of inaccurate data (Art. 16);
- erasure, except for data we must keep by law (Art. 17);
- restriction of processing (Art. 18);
- portability of the data you provided, in a readable format (Art. 20);
- to object to processing based on legitimate interest (Art. 21);
- to withdraw your consent to cookies from the , without affecting processing already carried out.
Write to info@wbchild.it, stating your order number if you have one: we reply within 30 days. If you believe the processing breaches the GDPR you can lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it).
6. Other information
- Automated decisions: we do not take decisions based solely on automated processing, nor do we carry out profiling (Art. 22).
- Minors: purchases are reserved for adults. We do not knowingly collect data from children under 14.
- Security: the site uses an encrypted connection (HTTPS); access to data is limited to authorised persons and password-protected.
- Fonts and resources: fonts are hosted on our own server, so browsing does not send your IP address to Google or other font providers.
- Cookies: all details are in the cookie policy.
- Changes: any updates to this policy are published on this page, with the date at the top.