Privacy Policy
Last updated: 27 September 2026
Here we explain what data we collect on www.teddyflash.com, why, and what rights you have (art. 13 of EU Regulation 2016/679, «GDPR»).
1. Data controller
LipsiaGROUP S.r.l. Unipersonale, Via Galli 35/37, 21049 Tradate (VA), Italy, VAT no. IT02944320122.
Privacy email: amministrazione@lipsiagroup.com
2. What data we collect
- Order data: first and last name, delivery and billing address, email, phone, tax code or VAT number if any, products purchased.
- Gift recipient data: name and address of the person you ship to, if different from you. Enter them only if that person is happy to receive the parcel.
- Payment data: handled by the payment provider. We never see the full card number.
- Account: email and password, if you create an account.
- Newsletter: your email, if you sign up.
- Customer service: what you write to us by email, phone or contact form.
- Browsing data and cookies: IP address, browser, pages visited. Non-essential cookies and tools run only with your consent, which you give or refuse in the site banner.
Order data is required: without it we cannot deliver. Everything else is optional.
3. Why we use it and on what legal basis
| Purpose | Legal basis | How long |
|---|---|---|
| Handle order, payment, shipping, returns and guarantee | Contract (art. 6.1.b GDPR) | Length of the relationship, then 10 years for tax documents |
| Tax and accounting obligations | Legal obligation (art. 6.1.c GDPR) | 10 years |
| Answer your requests | Contract or your request (art. 6.1.b GDPR) | As long as needed to handle them |
| Newsletter and offers | Consent (art. 6.1.a GDPR) | Until you unsubscribe |
| Site usage statistics | Consent | As stated in the cookie banner |
| Advertising and remarketing | Consent | As stated in the cookie banner |
| Prevent fraud and defend our rights | Legitimate interest (art. 6.1.f GDPR) | As long as needed |
You can unsubscribe from the newsletter at any time with the link at the bottom of every email.
4. Who we share data with
Only with those we need to provide the service. They act as data processors, or as independent controllers where the law provides so:
- website hosting and platform providers, with servers in the European Union;
- payment providers;
- couriers;
- email and newsletter service;
- tax and accounting advisers;
- analytics and advertising tools, only with your consent.
You can ask for the current list by writing to the privacy email. We do not sell your data.
5. Transfers outside the EU
If a provider processes data outside the European Union, it does so only with the safeguards required by the GDPR: a European Commission adequacy decision or standard contractual clauses.
6. Your rights
At any time you can ask to:
- know what data we hold and get a copy;
- correct or delete it;
- restrict its use or object to processing;
- receive your data in a readable format (portability);
- withdraw consent, without affecting what was done before.
Email amministrazione@lipsiagroup.com. We reply within 1 month.
You can also complain to the Italian Data Protection Authority, Garante per la protezione dei dati personali (www.garanteprivacy.it).
7. Children
The site is not aimed at children under 14. Purchases must be made by an adult, including for kids' items.
8. Security
We use a secure connection (HTTPS) and limit access to data to the people who need it.
9. Changes
We may update this notice. The date at the top shows the latest version.