Privacy Policy

Last updated: 7 settembre 2026.

Who processes your data

The data controller is MERLIN'S ORGANISATION DI MERLIN E. E C. S.A.S., registered office at Via Belle Arti, 8 — 37053 Cerea (VR), Italia, VAT number 00247000235.

For any question about this notice, or to exercise your rights, write to info@mobilimerlin.com or call +39 0442 83002 +39 3478916852.

We have not appointed a data protection officer, because none of the cases in which the law requires one applies to us.

What data we collect

What you give us. Name and surname, email address, telephone number, delivery and billing address and — if you ask for an invoice — tax code, VAT number, recipient code or certified email address. If you open an account, also your password, which we store encrypted and which none of us can read.

What the purchase itself produces. What you ordered, when, at what price, how you paid, where it was shipped, whether you asked for a return and how it ended.

Technical data. IP address, device and browser type, pages visited, date and time. They keep the site running and protect it from abuse.

We never see your card details. Number, expiry date and security code are typed into a Stripe form and travel straight to Stripe: all that reaches us is the outcome and the last four digits.

Why we process them, and on what legal basis

• To give you what you bought — handling the order, taking payment, shipping, answering when you write. The legal basis is the contract (Art. 6(1)(b) GDPR): without these data the order cannot be fulfilled.
• Because the law requires it — keeping accounting records and tax documents (Art. 6(1)(c) GDPR).
• To protect a legitimate interest of ours (Art. 6(1)(f) GDPR) — preventing fraud and unauthorised payments, keeping the site secure, establishing or defending a legal claim.
• Because you said yes (Art. 6(1)(a) GDPR) — newsletter, non-essential cookies, back-in-stock alerts. You can withdraw consent whenever you like, and withdrawing it does not affect what was done before.

How long we keep them

• Order data and accounting documents: ten years from the end of the financial year, as tax and civil law require.
• Customer account: as long as you keep it open. If you close it, your profile data are deleted and your orders remain in anonymous form, because the law obliges us to keep them.
• Newsletter: as long as you stay subscribed. Every email carries the unsubscribe link, and from there removal is immediate.
• Technical and security logs: twelve months.
• Enquiries from the contact form: twenty-four months, then deleted.

Who we share them with

We do not sell data to anyone and we do not pass them on for third-party advertising. They are seen only by those we need in order to work, each acting as a processor and each bound by the agreement Art. 28 GDPR requires:

• the providers hosting our website and email;
• Stripe Payments Europe Ltd (Ireland), to take card payments;
• Brevo (France), to send confirmation emails and the newsletter;
• the couriers we hand the parcel to, who receive name, address and telephone number because without them they cannot deliver;
• our accountant and, where needed, a lawyer.

Data may also be disclosed to judicial or public authorities where a rule of law obliges us to.

If data leave Europe

Our providers process data within the European Economic Area. Where a transfer to a third country is unavoidable, it takes place under an adequacy decision of the European Commission or under the standard contractual clauses provided for by Art. 46 GDPR, together with any additional measures required.

Automated decisions and profiling

We do not take decisions concerning you by solely automated means, and we do not carry out profiling. Stripe's fraud check analyses the transaction, not the person, and one of us always reviews the outcome before an order is refused.

What you can ask for

Articles 15 to 22 of the Regulation give you the right to:

• know whether we process data about you and obtain a copy;
• have them corrected if they are wrong or incomplete;
• have them erased, where no legal obligation requires us to keep them;
• ask us to restrict their use while a dispute of yours is open;
• receive them in a machine-readable format, or have them transferred to another provider;
• object to processing based on our legitimate interest;
• withdraw a consent you had given us.

To exercise them, just write to info@mobilimerlin.com. We reply within one month; if the request is complex we may take two more, telling you so.

You can also delete your account and your data yourself, from your personal area, without going through us.

If you think we are getting it wrong

You may lodge a complaint with the Italian Data Protection Authority, Piazza Venezia 11, 00187 Rome — www.garanteprivacy.it. You remain free to go to court.

Minors

This site is not aimed at children under sixteen and we do not knowingly collect their data. If you notice that a child has left us data, write to us: we will delete them.

Cookies

Cookies and similar technologies have a page of their own: Cookie policy.

If we change this notice

When the way we handle data changes, we update this page and change the date at the top. If the change is substantial and concerns you directly, we tell you by email before it takes effect.