Personal data processing information. Effective from July 20, 2026

PREMISE

This information takes into account the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (GDPR) and the Privacy Code (Legislative Decree 30 June 2003 n. 196). The document was also drawn up based on the Privacy Guarantor's Guidelines (especially the Anti-Spam Guidelines issued by the Privacy Guarantor on July 4, 2013).

Data Controller: TENSOTEX S.r.l., SS 96 km 116 065, 70026 Modugno (BA), VAT number 07867510724, Bari Chamber of Commerce, REA 587195, Phone: +39 080 8763774, Email: info@tensotex.com

Website to which this privacy policy refers: https://auralivingstore.it/ (Website).

The Data Controller has not appointed a DPO (Data Protection Officer). Therefore, you can send any request for information directly to the Data Controller.

GENERAL INFORMATION

This document describes how the Data Controller processes your personal data provided on the Website.

The main processing of your personal data is described below. In particular, the legal basis for the processing, whether the provision is mandatory, and the consequences of not providing personal data are explained. To better describe your rights, if necessary, we have specified if and when a certain personal data processing is not carried out. On the Website, you have the possibility to enter third-party personal data. In this case, you guarantee that you have obtained the consent of these individuals to enter this personal data. Therefore, you undertake to indemnify and hold harmless the Data Controller from any liability.

Website Registration

The information and data requested during registration will be used to allow you both to access the reserved area of the Website and to use the online services offered by the Data Controller to registered users. The legal basis for the processing is the Data Controller's need to perform pre-contractual measures adopted at the request of the data subject. The provision of data is optional. However, your refusal to provide the data will make it impossible to register on the Website. On the Website, it is also possible to register using external services. In this case, your registration data will be shared with the companies of these external services for the sole purpose of allowing registration on the Website. The legal basis for this processing is the legitimate interest of the Data Controller to allow registration on the Website through external services. The provision of personal data for this purpose is purely optional. However, failure to consent to the processing of data will make it impossible to register through external services.

Purchases on the Website

Your personal data will be processed to allow you to make purchases on the Website. In the case of placing an online purchase order, to allow the conclusion of the purchase contract and the correct execution of the operations related thereto (and, if necessary according to sector regulations, to fulfill tax obligations). This processing of personal data also includes the possibility of sending communications (e.g., tracking, order information, and request for a review) through automated tools such as email and/or SMS and/or WhatsApp. The legal basis for the processing is the Data Controller's obligation to perform the contract with the data subject or to comply with legal obligations. Notwithstanding the above (and therefore your consent), the Data Controller may process your data for so-called "soft-spam" purposes, regulated by art. 130 of the Privacy Code. This means that limited to the email you provided in the context of a purchase through the Website, the Data Controller will process the email to allow the direct offer of similar products/services, provided that you do not object to such processing in the manner provided for in this information. The legal basis for the processing is the legitimate interest of the Data Controller to send this type of communication. This legitimate interest can be considered equivalent to the data subject's interest in receiving "soft-spam" communications. The Data Controller may send emails to remind the user to complete a purchase. The legal basis for this processing is the legitimate interest of the Data Controller to send this type of communication. The Controller does not offer products or services prohibited to minors under 18 years of age. Consequently, there is no specific age verification system, as there are no legally restricted contents.

Responding to Your Requests

Your data will be processed to respond to your information requests. Providing the data is optional, but your refusal will make it impossible for the Data Controller to answer your questions. The legal basis for the processing is the Data Controller's legitimate interest in following up on user requests. This legitimate interest is equivalent to the user's interest in receiving a response to communications sent to the Data Controller. If you fill out the appropriate form on the Website, the Data Controller may use personal data to manage the request for a quote and/or intervention. Providing the data is optional, but without it, the Controller will not be able to process the request. The legal basis for the processing is the legitimate interest of the Data Controller in responding to requests sent by users, an interest that corresponds to the user's interest in receiving a response. The Controller may also process personal data for the purpose of managing support requests (tickets). In this case too, the legal basis is the legitimate interest of the Controller in providing feedback, in line with the user's interest in receiving support.

Generic Marketing

With your consent, the Data Controller may process the personal data you provide in order to send you advertising material and/or newsletters relating to its own or third-party products. The legal basis for this processing is your consent. The provision of personal data for this purpose is purely optional. Failure to consent to the processing of data for marketing purposes will make it impossible for you to receive advertising material relating to the Data Controller's and/or third-party products/services, as well as making it impossible for the Data Controller to carry out market research, including those aimed at evaluating user satisfaction, and to send you newsletters. These communications will be sent to the email and/or telephone number you provided on the Website (in the latter case also via SMS and/or WhatsApp). We use Google services, such as Google Ads and Google Analytics, to personalize advertisements and improve the user experience. This includes the collection of personal data and cookies, used to show you ads in line with your preferences. At the time of consent, you will be asked to authorize the use of this data. More details on the use of cookies and consent management are available in the cookie policy of this website.

Profiling

Subject to your consent, the Data Controller may process your personal data for profiling purposes, i.e., for the analysis of your consumption choices through the detection of the type and frequency of purchases you have made, in order to send you advertising material and/or newsletters relating to its own or third-party products, of your specific interest. The legal basis for this processing is your consent. The provision of data for this purpose is purely optional. Failure to consent to the processing of your personal data for profiling purposes will make it impossible for the Data Controller to process your commercial profile, by detecting your purchasing choices and habits, and to send you advertising material relating to the Data Controller's and/or third-party products, of your specific interest. These communications will be sent to your email and/or your telephone number (in the latter case also via SMS and/or WhatsApp).

Data Transfer

The Data Controller does not transfer your personal data to third parties.

Geolocation

The Website does not implement IP address geolocation tools for the user.

Curriculum Vitae

It is not possible to submit CVs via the Website. Therefore, your data will not be processed for these purposes.

Appointment Booking

No third-party appointment booking systems with the Data Controller are active on the Website. Therefore, your data will not be processed for this purpose. In any case, you can always contact the Data Controller using the contact details provided in the header.

Photographs and videos

The Data Controller does not request the publication of photographs and/or videos portraying you. Therefore, your data will not be processed for these purposes.

Web scraping

The use of any automated process or system to access, acquire, copy, or monitor any part of our website, including, but not limited to, web scraping, crawling, or spidering techniques, is expressly prohibited. The Data Controller reserves the right to take all necessary measures, including legal action, to prevent and prosecute any unauthorized scraping activity. By using the Website, the user or any third party undertakes not to: (i) use automated systems, such as bots, scrapers, or spiders, to access or interact with the Website; (ii) collect content, data, or other information present on the Website without explicit written authorization; (iii) distribute, display, publish, or otherwise use content acquired through scraping techniques without consent. Any violation of this clause will be considered a material breach of the Website's terms of use and will result in the adoption of appropriate measures, including the possible suspension of access to the website and the initiation of legal action to protect the Data Controller's interests.

Communication of personal data

In the context of its ordinary activities, the Data Controller may communicate your personal data to certain categories of subjects. Article 2 lists the subjects to whom the Data Controller reserves the right to communicate your personal data. To facilitate the protection of your rights, Article 2 may in some cases specify when your data is not communicated to third parties.

The "communication" of personal data to third parties is different from its "transfer" (governed by the preceding point). In fact, in communication, the third party to whom the data is transmitted can only use it for the specific purposes described in the relationship with the Data Controller. In transfer, on the other hand, the third party becomes an autonomous Data Controller of the personal data. Furthermore, your consent is always required to transfer your personal data to third parties.

Without prejudice to the foregoing, it is understood that the Data Controller may nevertheless use your personal data to properly fulfill the obligations provided for by current laws.

SPECIFIC PRIVACY INFORMATION

Art. 1 Processing methods

1.1 The processing of your personal data will be mainly carried out with the aid of electronic or otherwise automated means, according to methods and with tools suitable to guarantee the security and confidentiality of personal data.

1.2 The information acquired and the processing methods will be relevant and not excessive with respect to the type of services provided. Your data will also be managed and protected in secure IT environments appropriate to the circumstances.

1.3 "Special categories of data" are not processed through the Website. Special categories of data are those that can reveal racial or ethnic origin, religious, philosophical, or other beliefs, political opinions, membership of parties, trade unions, associations or organizations of a religious, philosophical, political, or trade union nature, health status, and sexual life.

1.4 Judicial data is not processed through the Website.

Art. 2 Communication of personal data

The Data Controller may communicate your personal data to specific categories of subjects. Below are the subjects to whom the Data Controller reserves the right to communicate your data:

  • The Data Controller may communicate your personal data to all those subjects (including Public Authorities) who have access to personal data by virtue of regulatory or administrative provisions.
  • Your personal data may also be communicated to all those public and/or private subjects, natural and/or legal persons (legal, administrative, and tax consultancy firms, Judicial Offices, Chambers of Commerce, Labor Chambers and Offices, etc.), if the communication is necessary or functional to the correct fulfillment of legal obligations.
  • The Data Controller makes use of employees and/or collaborators of any kind. For the proper functioning of the Website, the Data Controller may communicate your personal data to these employees and/or collaborators.
  • In its ordinary activity of managing the Website, the Data Controller uses companies, consultants, or professionals in charge of the installation, maintenance, updating, and, in general, the management of the Data Controller's hardware and software or those it uses to provide its services. Therefore, only with reference to these purposes, your data may also be processed by these subjects.
  • To send its communications, the Data Controller uses external companies in charge of sending this type of communication (CRM platforms). Your personal data (in particular your email) may therefore be communicated to these companies.
  • The Data Controller does not use external companies to provide customer care services.
  • The Data Controller uses banking institutions and companies that manage national and international payment circuits for online payments for products and services purchased through the Website.
  • The buyer's personal data may be communicated to post offices, couriers, or shipping agents responsible for delivering the Products purchased through the Website.
  • The personal data of buyers are not communicated to generative artificial intelligence technology providers.

The Controller reserves the right to modify the above list based on its ordinary operations. Therefore, you are invited to regularly access this information to check to whom the Data Controller communicates your personal data.

Art. 3 Retention of personal data

3.1 This article describes how long the Data Controller reserves the right to retain your personal data.

  • Your personal data will be kept only for the time necessary to ensure the correct provision of services offered through the Website.
  • For the purpose of executing the sales contract, the data will be retained for 10 years from the date of receipt of the purchase order. This is to allow the Data Controller to exercise its right of defense and to demonstrate that it has correctly executed the contract.
  • For customer care purposes, the data will be deleted once the assistance service is completed and, in any case, within a maximum of 3 months from the last email exchange with the data subject.
  • As provided for by article 2220 of the Civil Code, invoices, as well as all accounting records in general, are kept for a minimum period of ten years from the date of registration, so that they can be presented in case of inspection.
  • Through the Website (or by making a request to the Data Controller) it is possible to delete the user's account. In this case, all personal data stored will be deleted and will not be retained by the Data Controller for any purpose.
  • For marketing purposes, unless consent is revoked earlier, the data is kept for 24 months from the time it is provided. After the consent is revoked or the 24-month period expires, personal data will be deleted and no longer used for marketing purposes.
  • For "profiled" marketing purposes, unless consent is revoked earlier, data will be stored for 12 months from the date of provision. Following the revocation of consent or at the end of the 12-month period, personal data will be deleted and no longer used for this purpose.
  • Personal data provided through the quote request form will be stored for the time strictly necessary to respond to the request and, in any case, for a period not exceeding 6 months from its receipt. After this period, the data will be deleted or anonymized, unless there are any legal obligations that require a longer retention period.

3.2 Notwithstanding the provisions of Article 3.1, the Data Controller may store your personal data for the time required by specific regulations, as amended from time to time.

Art. 4 Transfer of personal data

4.1 The Data Controller is located in a country that has an adequate level of security from a regulatory point of view. If the transfer of your personal data takes place in a country outside the EU for which the European Commission has expressed an adequacy decision, the transfer is in any case considered secure from a regulatory point of view. This Article 4.1 indicates from time to time the countries to which your personal data may be transferred and for which the European Commission has expressed an adequacy decision.

  • Your personal data may be transferred to the USA based on the European Commission's adequacy decision. With this decision, the European Commission has determined that the USA offers personal data protection comparable to that offered by the European Union.
  • To allow the proper operation of the Website, your personal data may be transferred abroad. This is permitted based on the European Commission's decision of December 20, 2001, no. 2002/2/EC (published in the Official Journal of the European Communities L 2/13 of January 4, 2002) which found that Canada ensures an adequate level of protection for personal data transferred from the European Union to recipients subject to the Canadian Personal Information Protection and Electronic Documents Act ("the Canadian Act") of April 13, 2000.

4.2 Notwithstanding what is indicated in Article 4.1, your data may also be transferred to non-EU countries for which the European Commission has not expressed an adequacy decision. You are therefore invited to regularly consult this Article 4.2 to ascertain in which of these countries your data may be transferred.

4.3 In this article, the Data Controller indicates the countries to which it specifically directs its activity. This circumstance may imply the application of the relevant country's legislation, together with that governing the relationship with the user as indicated in the Preamble. 

  • Upon user request, the Data Controller will apply the most favorable legislation provided by the user's national law to the processing of personal data.

Art. 5. Rights of the data subject

The Data Controller informs you that you have the right to:

  • request from the Data Controller access to your personal data and the rectification or erasure thereof or the restriction of processing concerning you or to object to their processing, as well as the right to data portability
  • withdraw consent at any time without affecting the lawfulness of processing based on consent given before its withdrawal
  • lodge a complaint with a supervisory authority.

The above rights may be exercised by making an informal request to the contacts indicated in the Preamble.

Art. 6. Amendments and Miscellaneous

The Data Controller reserves the right to make changes to this policy at any time, giving adequate publicity to Website users and in any case ensuring adequate and similar protection of personal data. In order to view any changes, you are invited to regularly consult this policy. In the event of substantial changes to this privacy policy, the Data Controller may also communicate them via email.