Privacy policy

1. Who is responsible

Shade & Siesta S.r.l., a company established in Italy, trading as Shade & Siesta, runs this storefront. For anything to do with your data — a copy, a correction, a deletion — write to hello@shadeandsiesta.com. Email is the only contact channel we publish, and the one we answer.

2. The short version

Your basket, your saved frames, your discount code and your cookie choice live in your own browser’s local storage. They are never sent to us. The only personal data that reaches us is what you type into an order or an email, and we keep that only as long as the law and the guarantee require.

3. What we hold and why

Data	Purpose	Basis	Retention
Name, address, email, phone if given	Fulfilling and delivering your order	Contract	10 years (Italian tax law)
What you ordered - frame, size, lens - and what you paid	Order handling, returns, the 2-year guarantee	Contract	10 years, then anonymised
Payment confirmation, never card numbers	Knowing the order is paid	Contract	10 years
Email address on its own	The newsletter, if you signed up	Consent	Until you leave
Basket, saved frames, discount code, cookie choice	Keeping your basket between visits	Strictly necessary	In your browser only; never transmitted
Aggregate page and frame views	Seeing which shapes people look at	Consent	13 months, aggregated

Card details go straight to the payment provider. We never see them and never store them.

4. Local storage: what stays on your device

This site stores the following in your browser’s local storage, under keys beginning sas_: the contents of your basket, the frames you have saved for later, any discount code you have entered, the last order reference shown to you, the frames you viewed most recently, and whether you have dismissed the cookie bar. None of it is transmitted to us or to anyone else; we cannot read it. Clearing your browser’s site data removes all of it, and so does the “Remove” button in the basket.

5. Cookies and the cookie bar

• Necessary. Your basket, your cookie choice and session security. Set regardless, because the shop does not function without them. Choosing “Basket only” on the bar keeps exactly these.
• Measurement. Aggregate counts of page and frame views, with IP addresses truncated before storage. Set only if you choose “Fine by me” on the cookie bar, and removed if you later choose “Basket only”.

No advertising cookies, no cross-site tracking, no data brokers, no social-media pixels.

6. Who else sees it

Only the processors needed to run the shop, each under a data processing agreement and each receiving only what it needs:

• The payment provider — name, email, amount
• The carrier — name, address, phone if given
• The email service — email address, for order mail and the newsletter
• The hosting provider — server logs including IP addresses, kept 30 days

We do not sell personal data and we do not share it for anyone else’s marketing.

7. Outside the EEA

Our processors are inside the EEA wherever we can arrange it. Where one is not, the transfer is covered by the European Commission’s Standard Contractual Clauses.

8. Your rights

Under the GDPR you can ask for a copy of your data, have it corrected or deleted, restrict how it is used, or have it passed to another provider. You can object to processing based on legitimate interests and withdraw consent at any time. Email hello@shadeandsiesta.com; we answer within 30 days and usually within a few.

Where tax law obliges us to keep something, we will say so rather than delete it, and delete it when the period ends.

9. Complaints

You can complain to the Italian data protection authority, the Garante per la protezione dei dati personali. We would rather hear from you first so we can put it right.

10. Changes

If this policy changes in a way that matters, the date at the top changes and we note what moved. Earlier versions are available on request.

Terms & conditions