Privacy policy
Last updated: 9 November 2026
1. Who we are
Your data is handled by Uniongraphics S.r.l., the company behind United Colors of Naples (the controller):
- address: Salita Tarsia 77, 80135 Napoli (NA), Italia;
- VAT number (Partita IVA): IT10645101212;
- for anything to do with your data: customers@unitedcolorsposter.com, or WhatsApp +39 392 162 9364.
We don't have a data protection officer (DPO): a company like ours isn't required to have one.
2. What data we use and why
| What we do | What data | Why we're allowed to | How long we keep it |
|---|---|---|---|
| Taking and shipping your order, and writing to you at every step of the making | name, email, phone, addresses, the pieces you chose, the phrase on your piece, gift message | it's needed for the contract | 10 years after the order (tax obligations) |
| Invoice or pro forma, if you ask for one | tax code or VAT number, company name, SDI code or PEC | legal obligation | 10 years |
| Payment | handled by the payment providers (see point 3): we never see or keep your card number | contract | as above |
| Your account area (you sign in with a code sent by email, no password) | email, sign-ins | contract | as long as there are orders of yours; sign-in log 90 days |
| “Save it” and “Email me my cart” | email, saved pieces | you ask for it | we write to you at most 3 times in 2 days; wall links work for 90 days; carts you don't buy are deleted after 6 months |
| Newsletter | email, language, country; email opens and clicks | consent (you tap “Subscribe”) | until you unsubscribe, with a link in every email |
| Emails to customers about pieces similar to ones you've bought, and reminders about a cart you left | email, previous orders, cart | legitimate interest, except in Germany, Austria and Switzerland, where we ask for your consent | until you unsubscribe (link in every email) |
| Site statistics (Google Analytics 4) | pages viewed, device, country, an anonymous browser code | “Analytics” consent in the banner | 14 months |
| Recording of visits to the customiser, the wall and the cart, to understand where customers get stuck | movements and taps on the page, the phrase you write on your piece; email, phone and address are masked and can't be seen; linked to the cart and the order, never to your email | “Analytics” consent in the banner | 30 days |
| Advertising on Facebook and Instagram (pixel and data sent from our server to Meta) | pages viewed, cart, purchase, browser code; if you buy, email and phone made unreadable (hashed) | “Advertisement” consent in the banner | Meta's cookies are managed by Meta (see Cookie policy) |
| Measuring sales from Meta campaigns: when you pay for an order, we tell Meta about it from our server, even if you haven't accepted the “Advertisement” cookies, so we know which ads bring in real orders | order number, amount, pieces; email, phone, first name, last name, city, postcode and country made unreadable (hashed) before sending; a customer code of ours. No cookies read or written | legitimate interest in measuring the advertising we pay for | Meta uses them to match them with its users and then deletes them, under its own rules. You can object at any time by writing to customers@unitedcolorsposter.com: from then on, your orders are no longer sent |
| Cookie-free visit counter (how many people, from where) | pages, country, device type, with no data that identifies you | legitimate interest | 13 months |
| Security and fraud: blocking bots, too many attempts, suspicious payments | IP address, browser, attempts | legitimate interest | server logs about 7 days |
| Reviews | name (as you write it), text, photos, rating | consent, when you leave one | as long as it's published; we take it down if you ask us to |
| Customer support by email or WhatsApp | whatever you write to us | contract or your request | 2 years from the last message |
3. Who we share data with
These providers work for us (processors) and use the data only to provide their service to us:
| Who | What they do for us | Where |
|---|---|---|
| Render | hosts the site, the order system and the database | Frankfurt (EU) |
| Stripe | payments by card, Apple Pay, Google Pay, Klarna and Satispay (through Stripe) | EU and USA |
| PayPal | PayPal payments | EU (Luxembourg) and USA |
| Resend | sending emails (order, progress updates, newsletter) | USA (EU standard contractual clauses and Data Privacy Framework) |
| Packlink and couriers (BRT, DHL) | create the shipment and deliver it | EU; outside the EU only for shipments outside the EU |
| Cloudflare | bot protection (Turnstile) and storage of visit recordings | recordings in the EU; services worldwide |
| statistics (GA4) and Search Console | EU and USA | |
| Meta | advertising and campaign measurement; shop on Instagram and Facebook | EU and USA |
| CookieYes | cookie banner and record of your choices | EU (Ireland) and USA (Data Privacy Framework) |
| WhatsApp (Meta) | customer support, if you message us | EU and USA |
| Fatture in Cloud | invoices and pro formas | Italy |
| Accountant and advisers | bookkeeping | Italy |
Orders placed before October 2026: orders placed on our old shop also stay on Shopify until February 2027, so we can close off payments and refunds. After that we delete them. A copy of our old newsletter subscribers stays on Klaviyo until 20 November 2026, then we delete it.
Outside the EU (mainly the USA), data only goes to providers that are part of the EU-US Data Privacy Framework or sign the European Commission's standard contractual clauses.
Exception: for advertising and campaign measurement, Meta is a joint controller with us for collecting and sending the data, under Meta's joint controller agreement; it then also uses the data for its own purposes, as an independent controller.
We don't sell your data to anyone.
4. Cookies
Which cookies we use, by type, and how to change your choice: see the Cookie policy and the “Cookie preferences” button at the bottom of every page.
- Without your consent we only use technical cookies: cart, language, sign-in, your cookie choice, bot protection.
- If you say no, we won't ask for your consent again for 6 months.
5. Your rights
At any time, you can ask us to:
- see your data and get a copy of it;
- correct it;
- delete it, except for data the law requires us to keep, such as invoices;
- restrict how it's used;
- move it elsewhere;
- object to uses based on legitimate interest, including emails;
- withdraw a consent, whenever you like and with no effect on your orders.
Write to customers@unitedcolorsposter.com: we reply within 30 days.
You can also lodge a complaint with the Garante per la protezione dei dati personali (Italian Data Protection Authority) (garanteprivacy.it) or with the authority in your country.
6. Children
The site isn't meant for anyone under 14. We don't knowingly collect data from children.
7. Automated decisions
We don't make decisions about you using automated systems alone. Blocking bots and suspicious payments stops the transaction, not the person: you can always write to us.
8. Changes to this policy
If anything important changes, we'll note it here with the date and, if you're a customer, we'll let you know by email.