PRIVACY POLICY

(Pursuant to Arts. 13 and 14 of EU Regulation 2016/679 - GDPR)

Welcome to the website www.varaninistore.com. This policy describes how the website is managed with regard to the processing of personal data of users who consult it. This notice is provided pursuant to Regulation (EU) 2016/679 ("GDPR") and applicable national laws on personal data protection.

1. Data Controller

The Data Controller is GDR S.r.l., with registered and operational headquarters at Via Stelvio 9, 20900 Monza (MB), Italy. Contact email for privacy matters: ordini@varaninistore.com

2. Types of Data Processed

a) Navigation Data The computer systems and software procedures used to operate this website acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols (e.g., IP addresses, URI/URL addresses, time of the request, etc.). These data are used solely to obtain anonymous statistical information on the use of the site and to check its correct functioning.

b) Data Voluntarily Provided by the User The optional, explicit, and voluntary sending of e-mails to the addresses indicated on this site or the filling out of contact/order forms involves the subsequent acquisition of the sender's address, necessary to respond to requests, as well as any other personal data entered (e.g., Name, Surname, Shipping Address, Tax Code/VAT Number).

3. Purpose and Legal Basis of Processing

Personal Data collected will be processed for the following purposes:

1. Execution of the requested service: To manage orders, shipments, invoicing, and customer support.

   • Legal basis: Performance of a contract to which the data subject is party or pre-contractual measures.

2. Legal obligations: To fulfill obligations provided for by laws and regulations (e.g., tax and accounting laws).

   • Legal basis: Legal obligation.

3. Security and maintenance: To ensure network security and prevent fraudulent or harmful activities for the website.

   • Legal basis: Legitimate interest of the Controller.

4. Soft-Spam (Marketing to existing customers): To send commercial communications via email regarding services or products similar to those already purchased by the user, unless the data subject objects.

   • Legal basis: Legitimate interest.

5. Marketing and Newsletter (General): To send newsletters, promotional offers, and market research (other than point 4).

   • Legal basis: Explicit consent of the data subject (optional and revocable at any time).

4. Methods of Processing and Security

Processing will be carried out using manual, IT, and telematic tools, in compliance with current regulations and the principles of fairness, lawfulness, transparency, and confidentiality. GDR S.r.l. adopts specific technical and organizational security measures (e.g., HTTPS protocol, firewalls, password-protected access) to prevent data loss, illicit or incorrect use, and unauthorized access.

5. Recipients of Data

Data will not be disseminated but may be communicated to authorized subjects for the performance of activities necessary for the purposes indicated above, such as:

• Employees and collaborators of the Controller (as authorized personnel).

• Third-party technical service providers, postal couriers, hosting providers, IT companies, tax consultants (appointed, where necessary, as Data Processors).

6. Data Transfer Outside the EU

Data is stored on servers located within the European Union. Should it become necessary, for technical/operational reasons, to use subjects located outside the EU (e.g., Google for statistics), the transfer will take place in compliance with the Adequacy Decisions of the European Commission or following the adoption of Standard Contractual Clauses.

7. Data Retention Period

• Data for contractual/tax purposes: Retained for 10 years as required by law.

• Data for marketing purposes: Retained until the user revokes consent (unsubscribe).

• Navigation data: Deleted immediately after processing (subject to the need to ascertain crimes).

8. Rights of the Data Subject

In accordance with Arts. 15-22 of the GDPR, the user has the right to:

• Request confirmation of the existence or otherwise of their personal data.

• Obtain information about the purposes of processing, categories of personal data, recipients, and retention period.

• Obtain rectification and erasure of data ("right to be forgotten").

• Obtain restriction of processing.

• Obtain data portability.

• Object to processing at any time.

• Revoke previously given consent.

To exercise these rights, the user may write to: ordini@varaninistore.com.

COOKIE POLICY

What are Cookies?

Cookies are small text files that websites visited by users send to their terminals, where they are stored to be re-transmitted to the same sites on subsequent visits.

Types of Cookies used by this website

1. Technical Cookies (Necessary)

These are essential for the correct functioning of the website and to allow navigation (e.g., maintaining the shopping cart, logging into the reserved area, language settings). No consent is required for these cookies.

• Duration: Session or persistent.

2. Analytical Cookies (Statistics)

This website uses Google Analytics to collect information, in aggregated form, on the number of users and how they visit the site.

• These cookies are assimilated to technical cookies when used directly by the site manager to collect information in aggregated and anonymized form (masked IP).

• If anonymization is not active or data is crossed by third parties, user consent via the banner is required.

3. Profiling and Marketing Cookies

These are aimed at creating user profiles and are used to send advertising messages in line with the preferences shown by the user during web navigation.

• The installation of such cookies requires the prior consent of the user (by clicking "Accept" on the banner or selecting preferences).

Consent Management and Disabling

Upon first access, the user can choose which cookies to accept via the appropriate Cookie Banner. At any time, the user can modify their preferences or revoke consent by accessing the "Cookie Preferences" area in the footer of the website.

Alternatively, cookies can be managed directly from browser settings:

• Chrome: Settings -> Privacy and security -> Cookies.

• Firefox: Options -> Privacy & Security.

• Safari: Preferences -> Privacy.

For more information on Google Analytics cookies and Opt-Out, visit: https://tools.google.com/dlpage/gaoptout?hl=en

Updates

This Privacy and Cookie Policy is updated as of January 1, 2026. The Controller reserves the right to make changes at any time by publicizing them to users on this page.